Detection rules › Splunk
ComputerDefaults UAC Bypass (Windows Event Log)
computerdefaults.exe is a legitimate Windows executable handling the Default Programs feature in Windows. This feature allows users to set default programs for specific tasks such as web browsing, email, and media playback. Threat actors may modify the registry to have computerdefaults.exe run arbitrary commands when executed, potentially leading to UAC bypass. This use case detects modifications to the registry key HKCU\Software\Classes\ms-settings\shell\open\command which is associated with computerdefaults.exe
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4657 | A registry value was modified. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '32258.57435'
title: ComputerDefaults UAC Bypass
description: 'computerdefaults.exe is a legitimate Windows executable handling the
Default Programs feature in Windows. This feature allows users to set default programs
for specific tasks such as web browsing, email, and media playback. Threat actors
may modify the registry to have computerdefaults.exe run arbitrary commands when
executed, potentially leading to UAC bypass. This use case detects modifications
to the registry key HKCU\Software\Classes\ms-settings\shell\open\command which is
associated with computerdefaults.exe. Atomics T1548.002 Test #5 Living Off the Land
Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR
"<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
"ADD" OR "Set-ItemProperty" OR "sp " OR "New-Item" OR "New-ItemProperty" OR "ni")
"\\software\\classes\\ms-settings\\shell\\open\\command" "DelegateExecute" | table
_time, host, user ObjectName, process, process_*, parent_process_name | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "ADD" OR "Set-ItemProperty" OR "sp " OR "New-Item" OR "New-ItemProperty" OR "ni") "\\software\\classes\\ms-settings\\shell\\open\\command" "DelegateExecute"
Stage 2: table
| table _time, host, user ObjectName, process, process_*, parent_process_name
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4657<" |
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "ADD" |
| 1 | "Set-ItemProperty" |
| 1 | "sp " |
| 1 | "New-Item" |
| 1 | "New-ItemProperty" |
| 1 | "ni" |
| 1 | "\\software\\classes\\ms-settings\\shell\\open\\command" |
| 1 | "DelegateExecute" |