Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

ALPHV/BlackCat – UAC Bypass Paired with Access-Token Impersonation

Alphv Defense Evasion Sentinel
MITRE ATT&CK
Bypass User Account Control
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (alphv)
What This Detects
Beyond the Rust encryptor's own CLI flags, ALPHV/BlackCat's documented privilege-escalation chain bypasses UAC and then creates a new process using an impersonated access token to operate with SYSTEM-level privileges.
Query
let uacBypass = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("fodhelper.exe","eventvwr.exe","sdclt.exe") and InitiatingProcessIntegrityLevel != "System"
| project DeviceName, BypassTime = Timestamp;
let tokenImp = DeviceEvents
| where Timestamp > ago(1d)
| where ActionType has_any ("TokenManipulation","CreateProcessWithToken")
| project DeviceName, TokenTime = Timestamp;
uacBypass
| join kind=inner tokenImp on DeviceName
| where TokenTime - BypassTime between (0min .. 30min)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.