Creation or modification of the default command executed when opening an application

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent Requires: eXtended Threat Hunting (XTH)
Detection Modules
ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Severity	Informational

Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.

Gain higher privileges by bypassing the User Account Control (UAC).

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Severity	Medium

Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.

Gain higher privileges by bypassing the User Account Control (UAC).

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Severity	Medium

Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.

Gain higher privileges by bypassing the User Account Control (UAC).

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Severity	Medium

Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.

Gain higher privileges by bypassing the User Account Control (UAC).

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Severity	Medium

Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.

Gain higher privileges by bypassing the User Account Control (UAC).