Auto-generated rule - file BypassUacDll.aps

Hunt Hypothesis

This detection identifies adversary attempts to bypass User Account Control (UAC) using a specific DLL mechanism, which is a common tactic for privilege escalation and silent execution of malicious payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel because UAC bypasses often serve as an early indicator of lateral movement or persistence that may not trigger high-severity alerts until the attack has already progressed.

YARA Rule

rule BypassUac_EXE {
	meta:
		description = "Auto-generated rule - file BypassUacDll.aps"
		author = "yarGen Yara Rule Generator"
		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
	strings:
		$s1 = "Wole32.dll" wide
		$s3 = "System32\\migwiz" wide
		$s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
		$s5 = "Elevation:Administrator!new:" wide
		$s6 = "BypassUac" wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the BypassUacDll.aps detection rule in an enterprise environment, along with targeted exclusion strategies:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) frequently loads a custom DLL to bypass UAC prompts during background update checks or feature installations. This often triggers the rule when the process injects BypassUacDll into the system context without user interaction.
  • Filter/Exclusion: Create an exclusion for the specific process path: C:\Program Files\Microsoft Office ClickToRun\OfficeClickToRun.exe. Additionally, exclude any child processes spawned by this parent that load DLLs containing “BypassUac” in their filename.

• Scenario: SCCM (Configuration Manager) Client Agent Tasks

  • Context: The System Center Configuration Manager client (ccmexec.exe) executes scheduled maintenance jobs (e.g., inventory scans or software deployments) that require elevated privileges without launching a full UAC dialog for the end-user. It utilizes the bypass mechanism to ensure seamless background operations.
  • Filter/Exclusion: Exclude process paths matching C:\Windows\CCM\ccmexec.exe. If the environment uses specific scheduled tasks, add an exclusion for the task name containing “Configuration Manager Client” or filter based on the user context NT SERVICE\CCMService.

• Scenario: Endpoint Detection and Response (EDR) Self-Protection

  • Context: Security agents like CrowdStrike Falcon (C-Drive.exe or falcon.sys) or Carbon Black often employ UAC bypass techniques to perform real-time scanning or policy updates. When the agent’s core engine loads its internal DLLs, it mimics the behavior of a standard UAC bypass, triggering this rule