| UAC Bypass via Windows Firewall Snap-In Hijack | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UAC Bypass Attempt via Windows Directory Masquerading | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Bypass UAC via Event Viewer | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UAC Bypass Attempt via Privileged IFileOperation COM Interface | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UAC Bypass via DiskCleanup Scheduled Task Hijack | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UAC Bypass via ICMLuaUtil Elevated COM Interface | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Disabling User Account Control via Registry Modification | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Local Account TokenFilter Policy Disabled | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Unusual Sudo Activity | Low | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Execution with Explicit Credentials via Scripting | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Apple Scripting Execution with Administrator Privileges | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Execution via Electron Child Process Node.js Module | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Full Disk Access Permission Check | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Suspicious TCC Access Granted for User Folders | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Potential Privacy Control Bypass via Localhost Secure Copy | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Potential Privacy Control Bypass via TCCDB Modification | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| UID Elevation from Previously Unknown Executable | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Potential Privilege Escalation via Recently Compiled Executable | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Privilege Escalation via CAP_SETUID/SETGID Capabilities | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Suspicious SUID Binary Execution (Auditd Sequence) | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Suspicious SUID Binary Execution | High | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |
| Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities | Medium | Elastic detection rules | Aug 27, 2026 | Elastic License 2.0 |