BIOC Informational

Unusual process spawned by changepk.exe

Attackers may use the changepk.exe built-in Windows tool to bypass UAC using an unusual initiator.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Privilege Escalation
Status:
Enabled
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Indicator:

Process action type = execution AND target process name != sppsvc.exe AND clipup.exe AND genvalobj.exe AND dllhost.exe AND trustedinstaller.exe AND sppextcomobj.exe AND dismhost.exe Process initiated by = changepk.exe

Preventable: yes