Cross-source coverage

T1548.002 / ATT&CK

Abuse Elevation Control Mechanism: Bypass User Account Control

126 rules · 118 families across 7 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box. An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.

Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

  • eventvwr.exe can auto-elevate and execute a specified binary or script.

Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.

Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmon

How MITRE says to detect it DET0388

Detection Strategy for T1548.002 – Bypass User Account Control (UAC)

Windows Analytic 1094

Detects a multi-event behavior chain involving UAC bypass attempts via known auto-elevated binaries (e.g., eventvwr.exe, sdclt.exe), unauthorized Registry changes to UAC-related keys, and anomalous process execution with elevated privileges but lacking standard parent-child lineage. Suspicious patterns include invocation of auto-elevated COM objects or manipulation of isolatedCommand Registry entries without consent prompts.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Security EventCode=4672
  • WinEventLog:Sysmon EventCode=13, 14
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=7

View on attack.mitre.org ↗

SigmaHQ/sigma

56 rules
Detection Severity Format
HackTool - Empire PowerShell UAC Bypass Critical Sigma
TrustedPath UAC Bypass Pattern Critical Sigma
Bypass UAC Using DelegateExecute High Sigma
Bypass UAC Using SilentCleanup Task High Sigma
Bypass UAC via CMSTP High Sigma
Bypass UAC via Fodhelper.exe High Sigma
Bypass UAC via WSReset.exe High Sigma
CMSTP UAC Bypass via COM Object Access High Sigma
Explorer NOUACCHECK Flag High Sigma
HackTool - UACMe Akagi Execution High Sigma

+ 46 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/protections-artifacts

30 rules
Detection Severity Format
Potential Privilege Escalation via Elevated IFileOperation Undefined Elastic TOML
Potential UAC Bypass via IElevatedFactoryServer Undefined Elastic TOML
Privilege Escalation via Polkit System Service Undefined Elastic TOML
UAC Bypass Attempt via CDSSync Scheduled Task Hijack Undefined Elastic TOML
UAC Bypass Attempt via Consent DLL Search Order Hijacking Undefined Elastic TOML
UAC Bypass Attempt via DCCW DLL Search Order Hijacking Undefined Elastic TOML
UAC Bypass Attempt via DismCore DLL Side-Loading Undefined Elastic TOML
UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder Undefined Elastic TOML
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer Undefined Elastic TOML
UAC Bypass Attempt via MMC DLL Search Order Hijacking Undefined Elastic TOML

+ 20 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

18 rules
Detection Severity Format
Disable UAC Remote Restriction Undefined SPL
Disabling Remote User Account Control Undefined SPL
Eventvwr UAC Bypass Undefined SPL
FodHelper UAC Bypass Undefined SPL
NET Profiler UAC bypass Undefined SPL
Sdclt UAC Bypass Undefined SPL
SilentCleanup UAC Bypass Undefined SPL
SLUI RunAs Elevated Undefined SPL
SLUI Spawning a Process Undefined SPL
UAC Bypass MMC Load Unsigned Dll Undefined SPL

+ 8 more from splunk/security_content → showing the 10 highest-severity

elastic/detection-rules

11 rules
Detection Severity Format
Bypass UAC via Event Viewer High Elastic TOML
UAC Bypass Attempt via Privileged IFileOperation COM Interface High Elastic TOML
UAC Bypass Attempt via Windows Directory Masquerading High Elastic TOML
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface High Elastic TOML
UAC Bypass via ICMLuaUtil Elevated COM Interface High Elastic TOML
Disabling User Account Control via Registry Modification Medium Elastic TOML
Local Account TokenFilter Policy Disabled Medium Elastic TOML
Potential PowerShell HackTool Script by Function Names Medium Elastic TOML
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer Medium Elastic TOML
UAC Bypass via DiskCleanup Scheduled Task Hijack Medium Elastic TOML

+ 1 more from elastic/detection-rules → showing the 10 highest-severity

Wazuh Core Ruleset

7 rules
Detection Severity Format
Powershell launched with a integrity level by · win.eventdata.parentImage = (?i)control\.exe, win.eventdata.integrityLevel = (?i)high Critical Wazuh XML
Powershell process invoked known auto-elevated utility , may have been used to bypass UAC · win.eventdata.parentCommandLine = (?i)powershell\.EXE Critical Wazuh XML
added to the registry a subkey associated with UAC bypass by auto-elevated processes · win.eventdata.image = (?i)(cmd|powershell)\.exe High Wazuh XML
Command interpreter added to registry key associated to UAC bypass by auto-elevated processes High Wazuh XML
Known auto-elevated utility may have been used to bypass UAC · win.eventdata.originalFileName = (?i)(ComputerDefaults|fodhelper)\.EXE High Wazuh XML
Possible use of fodhelper.exe used to bypass UAC and execute of malicious software High Wazuh XML
Modified registry key associated to UAC bypass by auto-elevated processes Medium Wazuh XML

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Powershell script: UAC bypass cmdlet detected High Wazuh XML
T1548.002: Bypass UAC via mscfile EventViewer hijack High Wazuh XML
T1548.002: Bypass UAC via mscfile EventViewer hijack (test rule) High Wazuh XML

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Potential Fodhelper UAC Bypass (ASIM Version) Medium KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.