Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Explorer NOUACCHECK Flag

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

ATT&CK coverage

Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control 86 detections cover this technique

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

Domain Controller User Logon
Unknown how many legitimate software products use that method

References

https://twitter.com/ORCA6665/status/1496478087244095491

Tagged by the source as

attack.privilege-escalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.