{ Security-in-bits }

T1548.002: Bypass User Account Control

ATT&CK technique · attack.mitre.org

UAC bypass analysis (Stage 1) Ataware Ransomware – Part 0x2
May 7, 2019
Ataware Ransomware uses UAC bypass using CMSTPLUA COM interface in ATAPIinit.exe (Stage 1). It was downloaded from Dropbox url when user open the malicious Excel.

Get the next detection in your inbox

One lab-proven detection per issue: the attacker command, the telemetry it leaves, and the KQL / ES|QL that catches it.

You confirm on Substack in one tap.

No spam. Unsubscribe anytime.