UAC Bypass Using ChangePK and SLUI — Detection Rule

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read the full analysis on IntelFusions