UAC Bypass via Windows Firewall Snap-In Hijack — Detection Rule

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read the full analysis on IntelFusions