Detecting UAC bypass - ChangePK and SLUI registry tampering

Back


Id	829a69ba-93e1-491f-8a1f-b19506e9d88a
Rulename	Detecting UAC bypass - ChangePK and SLUI registry tampering
Description	This query identifies setting a registry key under HKCU, launching slui.exe and then ChangePK.exe.
Severity	Medium
Tactics	Impact
Techniques	T1490
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/UACBypass-3-changePK-SLUI-tampering.yaml
Version	1.0.0
Arm template	829a69ba-93e1-491f-8a1f-b19506e9d88a.json

KQL

DeviceProcessEvents
| where InitiatingProcessParentFileName =~ "slui.exe"
| where InitiatingProcessFileName =~ "changepk.exe"
| where ProcessIntegrityLevel == "High"

YAML

triggerThreshold: 0
description: |
    This query identifies setting a registry key under HKCU, launching slui.exe and then ChangePK.exe.
severity: Medium
version: 1.0.0
query: |
  DeviceProcessEvents
  | where InitiatingProcessParentFileName =~ "slui.exe"
  | where InitiatingProcessFileName =~ "changepk.exe"
  | where ProcessIntegrityLevel == "High"  
tactics:
- Impact
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: DeviceName
  entityType: Host
- fieldMappings:
  - identifier: Sid
    columnName: AccountSid
  - identifier: Name
    columnName: AccountName
  - identifier: NTDomain
    columnName: AccountDomain
  entityType: Account
- fieldMappings:
  - identifier: CommandLine
    columnName: ProcessCommandLine
  entityType: Process
queryPeriod: 1h
relevantTechniques:
- T1490
queryFrequency: 1h
id: 829a69ba-93e1-491f-8a1f-b19506e9d88a
triggerOperator: gt
kind: Scheduled
name: Detecting UAC bypass - ChangePK and SLUI registry tampering
requiredDataConnectors:
- dataTypes:
  - DeviceProcessEvents
  connectorId: MicrosoftThreatProtection
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/UACBypass-3-changePK-SLUI-tampering.yaml

ARM