UAC Bypass via Mscfile Registry Key Modification

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to modify the registry key HKCU\Software\Classes\mscfile\shell\open\command to point to a malicious binary (e.g., c:\Users\AppData\Local\Temp\Malware.exe) for potential exploitation. This could be indicative of adversaries attempting to replace mmc.exe with a malicious binary for privilege escalation without triggering a UAC prompt. Executing any kind of .msc file will then execute the malicious binary with elevated privileges.

2025-03-07 00:00:00

None

a3e77c28-15b0-4f54-9a04-ac061b0aea00

attack.privilege-escalation attack.defense-evasion attack.t1548.002

Nextron Sigma feed only (private)