UAC Bypass via Windows Firewall Snap-In Hijack

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

This rule detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Specifically, it looks for the creation of a process where the parent process is 'mmc.exe' and its command line contains 'WF.msc', while filtering out legitimate 'WerFault.exe' processes.