Skip to content

feat(rules): New UAC bypass via RequestTrace scheduled task hijack rule#628

Merged
rabbitstack merged 1 commit intomasterfrom
privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack
Mar 5, 2026
Merged

feat(rules): New UAC bypass via RequestTrace scheduled task hijack rule#628
rabbitstack merged 1 commit intomasterfrom
privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack

Conversation

@rabbitstack
Copy link
Owner

What is the purpose of this PR / why it is needed?

Identifies attempts to bypass User Account Control (UAC) by abusing the RequestTrace scheduled task, a lesser-known but powerful auto-elevated Windows mechanism that can be repurposed by attackers to gain administrative-level execution without user consent.

What type of change does this PR introduce?


Uncomment one or more /kind <> lines:

/kind feature (non-breaking change which adds functionality)

/kind bug-fix (non-breaking change which fixes an issue)

/kind refactor (non-breaking change that restructures the code, while not changing the original functionality)

/kind breaking (fix or feature that would cause existing functionality to not work as expected

/kind cleanup

/kind improvement

/kind design

/kind documentation

/kind other (change that doesn't pertain to any of the above categories)

Any specific area of the project related to this PR?


Uncomment one or more /area <> lines:

/area instrumentation

/area telemetry

/area rule-engine

/area filters

/area yara

/area event

/area captures

/area alertsenders

/area outputs

/area rules

/area filaments

/area config

/area cli

/area tests

/area ci

/area build

/area docs

/area deps

/area evasion

/area other

Special notes for the reviewer


Does this PR introduce a user-facing change?


Identifies attempts to bypass User Account Control (UAC) by abusing the RequestTrace scheduled task, a lesser-known but powerful auto-elevated Windows mechanism that can be repurposed by attackers to gain administrative-level execution without user consent.
@rabbitstack rabbitstack added the rules Anything related to detection rules label Feb 19, 2026
@rabbitstack rabbitstack added the rules: uac bypass Anything related to UAC bypass detection rules label Feb 26, 2026
@rabbitstack rabbitstack merged commit d5552d1 into master Mar 5, 2026
14 of 15 checks passed
@rabbitstack rabbitstack deleted the privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack branch March 5, 2026 19:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

rules: uac bypass Anything related to UAC bypass detection rules rules Anything related to detection rules

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant