Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows Suspicious Child Process of Consent.EXE

The following analytic detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary. Consent.exe is responsible solely for rendering the UAC elevation prompt and should not spawn…

Description

The following analytic detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary. Consent.exe is responsible solely for rendering the UAC elevation prompt and should not spawn child processes under normal operating conditions; child process creation from this parent is a known indicator of UAC bypass and privilege escalation techniques. The detection identifies any executable launched as a child of consent.exe, excluding the expected WerFault.exe error reporting process, which may legitimately appear in crash scenarios. This behavior is associated with UAC bypass exploits and has been observed in multiple post-exploitation frameworks as a means of obtaining elevated privileges without triggering a visible UAC prompt.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Legitimate software installations or system updates may occasionally trigger child processes under consent.exe but these should be rare. Verify any flagged activity against known administrative actions or recent software changes.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice