UAC CMSTPLUA bypass

rule UAC_CMSTPLUA_bypass_bin
{
    meta:
        description = "UAC CMSTPLUA bypass"
        author = "James_inthe_box"
        reference = "https://isc.sans.edu/diary/25068"
        date = "2019/06"
        maltype = "TTP"

    strings:
        $string1 = "6EDD6D74-C007-4E75-B76A-E5740995E24C" ascii wide
        $string2 = "3E5FC7F9-9A51-4367-9063-A120244FBEC7" ascii wide
        $string3 = "%systemroot%\\system32\\cmd.exe" ascii wide
        $string4 = "Elevation:Administrator!new:" ascii wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule UAC_CMSTPLUA_bypass_mem
{
    meta:
        description = "UAC CMSTPLUA bypass"
        author = "James_inthe_box"
        reference = "https://isc.sans.edu/diary/25068"
        date = "2019/06"
        maltype = "TTP"

    strings:
        $string1 = "6EDD6D74-C007-4E75-B76A-E5740995E24C" ascii wide
        $string2 = "3E5FC7F9-9A51-4367-9063-A120244FBEC7" ascii wide
        $string3 = "%systemroot%\\system32\\cmd.exe" ascii wide
        $string4 = "Elevation:Administrator!new:" ascii wide

    condition:
        all of ($string*) and filesize > 800KB
}