Loading story…
Splunk published a Windows endpoint analytic that detects suspicious child processes launched by consent.exe, a behavior strongly associated with User Account Control (UAC) bypass and privilege escalation. Because consent.exe normally displays the UAC elevation prompt rather than spawning executables, the detection treats such process creation as anomalous, excluding WerFault.exe as a known crash-related exception. The analytic maps to MITRE ATT&CK techniques T1548.002, T1068, and T1059, and is designed for telemetry from Sysmon, Windows Security Event ID 4688, and CrowdStrike ProcessRollup2 data normalized into Splunk's Endpoint data model.
The release aligns with MITRE ATT&CK documentation showing UAC bypass remains a widely used post-compromise technique across ransomware operators, commodity malware, and state-linked intrusion groups. ATT&CK lists methods including COM abuse through CMSTPLUA, scheduled task abuse such as SilentCleanup, registry hijacks involving ms-settings and mscfile, and abuse of trusted Windows binaries including fodhelper.exe, eventvwr.exe, and sdclt.exe. Splunk also published supporting attack simulation data for suspicious child processes of consent.exe, giving defenders a way to test visibility for this privilege-escalation pattern, although the analytic is disabled by default and generates intermediate risk events rather than direct notable alerts.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk updated its "Windows Suspicious Child Process of Consent.EXE" anomaly detection for Splunk Enterprise Security. The analytic detects executable child processes spawned by consent.exe, a behavior Splunk identifies as a strong indicator of UAC bypass and privilege escalation, while excluding WerFault.exe as an expected exception.
Splunk published an attack simulation dataset titled "Windows Suspicious Child Of Consent.exe" for replay and testing in an attack_range environment. The dataset is associated with MITRE ATT&CK technique T1068 and includes Sysmon-formatted log data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
Security researchers documented and detection engineers tracked a Windows application control bypass technique in which **`rundll32.exe`** invokes the `LaunchINFSection` function in **`advpack.dll`**, **`ieadvpack.dll`**, or **`syssetup.dll`** to execute script content from INF files. The behavior is associated with LOLBAS tradecraft and can be abused to bypass allowlisting controls, enabling arbitrary code execution and creating opportunities for privilege escalation, persistence, and wider host compromise. Splunk published analytics to identify this activity using EDR and Windows process telemetry, including command-line logging, **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and CrowdStrike ProcessRollup2 data mapped to the Endpoint data model. Those detections, aligned to **MITRE ATT&CK `T1218.011`** for Rundll32, were later deprecated and replaced by a broader rule named **"Windows Application Whitelisting Bypass Attempt via Rundll32,"** while the underlying technique remained notable because legitimate use of these DLL invocation patterns is considered uncommon and potentially high-signal for malicious execution.
Aug 12, 2026
Splunk Threat Research has removed several endpoint analytics from its Security Content library, retiring detections for `chcp.com` execution, account discovery with the Windows `net` utility, and execution of files padded with spaces before the extension. Splunk said the `CHCP Command Execution` analytic was deprecated because `chcp.com` alone is not inherently malicious, while `Account Discovery With Net App` was withdrawn due to overlap with other detections and replaced by **Windows Excessive Usage Of Net App**. The filename-obfuscation analytic was also removed and superseded by **Execution of File with Multiple Extensions**. The retired rules had mapped to MITRE ATT&CK techniques **T1087.002** for domain account discovery and **T1036.003** for masquerading through renamed or disguised utilities. Those ATT&CK entries describe common adversary tradecraft including use of `net user /domain`, `net group "Domain Admins" /domain`, PowerShell AD cmdlets, and tools such as AdFind and BloodHound to enumerate domain accounts, as well as renaming or disguising legitimate binaries like `rundll32.exe`, `mshta.exe`, `cmd.exe`, and `wscript.exe` to evade detection. Splunk noted the removed analytics depended on endpoint process telemetry such as EDR and Sysmon data, were disabled by default, and could generate false positives from legitimate administrative activity.
Aug 12, 2026