BIOC
Informational
✕
Unusual process spawned by changepk.exe
Attackers may use the changepk.exe built-in Windows tool to bypass UAC using an unusual initiator.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Privilege Escalation
- Status:
- Enabled
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Indicator:
Process action type = execution AND target process name != sppsvc.exe AND clipup.exe AND genvalobj.exe AND dllhost.exe AND trustedinstaller.exe AND sppextcomobj.exe AND dismhost.exe Process initiated by = changepk.exe
Preventable: yes