Elevation Control Bypass Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the delivery of a tool designed to bypass User Account Control (UAC) via HTTP. It specifically looks for HTTP responses containing the strings "IsUserAnAdmin" and "ShellExecute" (case-insensitive) within the file data, indicating the presence of code commonly used in UAC bypass techniques.