anavem.
C
Medium RiskWindows
consent.exeEXECUTABLE

consent.exe - Windows UAC Consent Dialog [2026]

consent.exe is the Windows UAC consent UI that prompts for elevation. May be impersonated for credential harvesting or indicate UAC bypass attempts.

4viewsLast verified: Jan 18, 2025

Risk Summary

## Risk Summary | Factor | Assessment | |--------|------------| | Detection Difficulty | Medium | | Abuse Potential | Medium | | Prevalence | Universal | | Risk Score | 50/100 | consent.exe handles UAC prompts and may be impersonated or targeted in UAC bypass attacks.

Overview

What is consent.exe?

consent.exe is the Windows User Account Control (UAC) consent dialog process that displays elevation prompts when applications request administrator privileges.

Key Characteristics

AttributeValue
File Nameconsent.exe
DeveloperMicrosoft Corporation
Digital SignatureMicrosoft Windows
FeatureUser Account Control
TypeSecurity Dialog

Technical Details

PropertyDescription
Process TypeElevated UI Process
Parent Processsvchost.exe (appinfo)
PurposeDisplay UAC consent dialog
ProtectionSecure Desktop

consent.exe runs on the secure desktop to prevent spoofing by malware.

Normal Behavior

Normal Behavior

Legitimate Characteristics

Process: consent.exe
Parent: svchost.exe -k netsvcs -p
Location: C:\Windows\System32\consent.exe
Trigger: Elevation request

Expected Characteristics

AspectExpected Behavior
Parent Processsvchost.exe (appinfo)
LocationC:\Windows\System32\
TriggerUAC elevation request
DesktopSecure desktop
DurationBrief (user interaction)

Elevation Scenarios

ScenarioTrigger
Admin app launchUAC manifest
"Run as Administrator"User request
System changesWindows protection

Common Locations

C:\Windows\System32\consent.exe

Suspicious Indicators

Suspicious Indicators

Red Flags

IndicatorConcern LevelDescription
Wrong locationCriticalNot in System32
Wrong parentHighNot from svchost appinfo
Unusual frequencyMediumToo many UAC prompts
No secure desktopHighSpoofable dialog
User interactionMediumSocial engineering

UAC Bypass Indicators

UAC Bypass Patterns:
- Unexpected consent.exe invocation
- Auto-elevation abuse
- Environment variable manipulation
- COM object exploitation

Spoofing Concerns

AttackMethod
Fake dialogUI spoofing
Credential harvestPhishing creds
Elevation bypassUAC circumvention

Abuse Techniques

Abuse Techniques

Credential Phishing

Fake UAC Dialog:
1. Malware creates fake consent dialog
2. Mimics legitimate UAC prompt
3. User enters credentials
4. Credentials captured by attacker
5. Real elevation may or may not occur

UAC Bypass Abuse

Auto-Elevation Abuse:
1. Attacker finds auto-elevating binary
2. Hijacks DLL or environment
3. Bypasses UAC without prompt
4. consent.exe never invoked
5. Silent privilege escalation

Social Engineering

TechniqueImplementation
Frequency fatigueMany prompts desensitize user
False urgency"Critical update" prompts
Trust exploitationMimic trusted apps

Impersonation

Fake consent.exe:
- Create lookalike dialog
- Harvest administrator credentials
- Bypass secure desktop protection
- Phish users for passwords

Detection Guidance

Detection Guidance

Sysmon Configuration

<RuleGroup name="consent.exe Monitoring" groupRelation="or">
  <ProcessCreate onmatch="include">
    <Image condition="end with">consent.exe</Image>
  </ProcessCreate>
</RuleGroup>

Sigma Rule

title: Suspicious consent.exe Location
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\consent.exe'
  filter:
    Image: 'C:\Windows\System32\consent.exe'
    ParentImage|endswith: '\svchost.exe'
  condition: selection and not filter
  falsepositives:
    - None expected
  level: high

KQL Query

// consent.exe from wrong location or parent
DeviceProcessEvents
| where FileName =~ "consent.exe"
| where FolderPath != "C:\\Windows\\System32\\" or
        not(InitiatingProcessCommandLine contains "netsvcs")
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName

// High frequency UAC prompts (potential bypass attempts)
DeviceProcessEvents
| where FileName =~ "consent.exe"
| summarize PromptCount = count() by DeviceName, bin(Timestamp, 1h)
| where PromptCount > 20

Remediation Steps

Remediation Steps

Verification

# Check consent.exe instances
Get-Process consent -ErrorAction SilentlyContinue | ForEach-Object {
    [PSCustomObject]@{
        PID = $_.Id
        Path = $_.Path
        ParentPID = (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.Id)").ParentProcessId
    }
}

# Verify signature
Get-AuthenticodeSignature "C:\Windows\System32\consent.exe"

UAC Hardening

# Set UAC to highest level
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
Set-ItemProperty -Path $regPath -Name ConsentPromptBehaviorAdmin -Value 2
Set-ItemProperty -Path $regPath -Name PromptOnSecureDesktop -Value 1

Monitoring

ControlImplementation
High UAC levelAlways notify
Secure desktopEnable prompt on secure desktop
MonitoringLog elevation requests

Investigation Checklist

Investigation Checklist

Process Verification

  • Is consent.exe in System32?
  • Is parent svchost (appinfo)?
  • Proper Microsoft signature?
  • Running on secure desktop?

Activity Analysis

  • What triggered the UAC prompt?
  • Which application requested elevation?
  • Is the request legitimate?
  • User interaction normal?

Bypass Check

  • UAC bypass attempts detected?
  • Auto-elevation abuse?
  • Environment manipulation?

Spoofing Check

  • Any fake UAC dialogs?
  • Credential harvesting attempts?
  • Social engineering indicators?

MITRE ATT&CK Techniques

T1548.002 - Bypass User Account ControlT1056.002 - GUI Input Capture