Detects Win7Elevate - Windows UAC bypass utility

Hunt Hypothesis

The hypothesis is that an adversary is using the Win7Elevate tool to bypass Windows UAC and gain elevated privileges on a system. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential privilege escalation attempts and mitigate advanced persistent threats that exploit UAC bypass techniques.

YARA Rule

rule Win7Elevatev2 {
	meta:
		description = "Detects Win7Elevate - Windows UAC bypass utility"
		author = "Florian Roth"
		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
		date = "2015-05-14"
		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29" /* x64 */
		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1" /* x86 */
		score = 60
	strings:
		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
		$x3 = "Run the command normally (without code injection)" wide	
		$x4 = "Inject file copy && elevate command" fullword wide
		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
		
		$s1 = "\\cmd.exe" wide
		$s2 = "runas" wide
		$s3 = "explorer.exe" wide
		$s4 = "Couldn't load kernel32.dll" wide
		$s5 = "CRYPTBASE.dll" wide
		$s6 = "shell32.dll" wide
		$s7 = "ShellExecuteEx" ascii
		$s8 = "COMCTL32.dll" ascii 
		$s9 = "ShellExecuteEx" ascii
		$s10 = "HeapAlloc" ascii
	condition:
		uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

References

• http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html
• Source Rule

False Positive Guidance

• Scenario: Legitimate Use of runas for Administrative Tasks
  Description: An administrator uses the runas command to execute a script or application with elevated privileges as part of routine maintenance.
  Filter/Exclusion: Check for the presence of runas in the command line with a known administrative tool or script, and ensure the user is a domain admin or has a documented reason for elevation.

• Scenario: Scheduled Task Running with Elevated Privileges
  Description: A scheduled task configured to run with “highest privileges” is executing a legitimate maintenance script or application.
  Filter/Exclusion: Filter by task name or path that matches known enterprise maintenance tasks, and verify the task is configured with a valid service account.

• Scenario: Use of PsExec for Remote Administration
  Description: A system administrator uses PsExec to remotely execute a command on a Windows 7 machine as part of a sanctioned remote management process.
  Filter/Exclusion: Exclude processes initiated by PsExec that are associated with known remote management tools or scripts used in the enterprise.

• Scenario: Deployment of a Windows 7 UAC Bypass Tool for Compatibility
  Description: A legacy application or compatibility tool requires elevation and uses a known UAC bypass method, such as Win7Elevate, to function correctly on Windows 7 systems.
  Filter/Exclusion: Exclude processes that are part of a known enterprise compatibility toolset or are signed by a trusted vendor.

• Scenario: Malicious Tool Mimicking Legitimate UAC Bypass
  Description: A malicious tool uses a similar technique to Win7Elevate to bypass UAC, but the detection rule may flag it as a false positive due to similar behavior.
  Filter/Exclusion: Use behavioral analysis or signature-based filtering to distinguish between known