EXPLORE
← Back to Explore
T1548.002

Bypass User Account Control

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click thr...

Windows
83
Detections
3
Sources
11
Threat Actors

BY SOURCE

56sigma16splunk_escu11elastic

PROCEDURES (36)

Bypass16 detections

Auto-extracted: 16 detections for bypass

Bypass7 detections

Auto-extracted: 7 detections for bypass

Bypass6 detections

Auto-extracted: 6 detections for bypass

Persist4 detections

Auto-extracted: 4 detections for persist

Suspicious4 detections

Auto-extracted: 4 detections for suspicious

Registry4 detections

Auto-extracted: 4 detections for registry

Bypass4 detections

Auto-extracted: 4 detections for bypass

Process Creation Monitoring2 detections

Auto-extracted: 2 detections for process creation monitoring

Privilege2 detections

Auto-extracted: 2 detections for privilege

Child Process2 detections

Auto-extracted: 2 detections for child process

Token2 detections

Auto-extracted: 2 detections for token

Dll Hijack2 detections

Auto-extracted: 2 detections for dll hijack

Dll Hijack2 detections

Auto-extracted: 2 detections for dll hijack

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Tamper2 detections

Auto-extracted: 2 detections for tamper

Service2 detections

Auto-extracted: 2 detections for service

Unusual1 detections

Auto-extracted: 1 detections for unusual

Remote1 detections

Auto-extracted: 1 detections for remote

Powershell1 detections

Auto-extracted: 1 detections for powershell

Privilege1 detections

Auto-extracted: 1 detections for privilege

Child Process1 detections

Auto-extracted: 1 detections for child process

Persist1 detections

Auto-extracted: 1 detections for persist

Privilege1 detections

Auto-extracted: 1 detections for privilege

Child Process1 detections

Auto-extracted: 1 detections for child process

Process Access Monitoring1 detections

Auto-extracted: 1 detections for process access monitoring

Powershell1 detections

Auto-extracted: 1 detections for powershell

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Remote1 detections

Auto-extracted: 1 detections for remote

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Scheduled Task1 detections

Auto-extracted: 1 detections for scheduled task

Bypass1 detections

Auto-extracted: 1 detections for bypass

Dll Hijack1 detections

Auto-extracted: 1 detections for dll hijack

Module Load Monitoring1 detections

Auto-extracted: 1 detections for module load monitoring

Scheduled Task1 detections

Auto-extracted: 1 detections for scheduled task

Unusual1 detections

Auto-extracted: 1 detections for unusual

DETECTIONS (83)

Always Install Elevated MSI Spawned Cmd And Powershell
sigmamedium
Always Install Elevated Windows Installer
sigmamedium
Bypass UAC Using DelegateExecute
sigmahigh
Bypass UAC Using SilentCleanup Task
sigmahigh
Bypass UAC via CMSTP
sigmahigh
Bypass UAC via Event Viewer
elastichigh
Bypass UAC via Fodhelper.exe
sigmahigh
Bypass UAC via WSReset.exe
sigmahigh
CMSTP UAC Bypass via COM Object Access
sigmahigh
Disable UAC Remote Restriction
splunk_escu
Disabling Remote User Account Control
splunk_escu
Disabling User Account Control via Registry Modification
elasticmedium
Eventvwr UAC Bypass
splunk_escu
Explorer NOUACCHECK Flag
sigmahigh
FodHelper UAC Bypass
splunk_escu
Function Call From Undocumented COM Interface EditionUpgradeManager
sigmamedium
HackTool - Empire PowerShell UAC Bypass
sigmacritical
HackTool - UACMe Akagi Execution
sigmahigh
HackTool - WinPwn Execution
sigmahigh
HackTool - WinPwn Execution - ScriptBlock
sigmahigh
Local Account TokenFilter Policy Disabled
elasticmedium
NET Profiler UAC bypass
splunk_escu
Potential PowerShell HackTool Script by Function Names
elasticmedium
Potential UAC Bypass Via Sdclt.EXE
sigmamedium
Potentially Suspicious Event Viewer Child Process
sigmahigh
PowerShell Web Access Feature Enabled Via DISM
sigmahigh
Registry Modification of MS-settings Protocol Handler
sigmamedium
Sdclt Child Processes
sigmamedium
Sdclt UAC Bypass
splunk_escu
Shell Open Registry Keys Manipulation
sigmahigh
SilentCleanup UAC Bypass
splunk_escu
SLUI RunAs Elevated
splunk_escu
SLUI Spawning a Process
splunk_escu
Suspicious Shell Open Command Registry Modification
sigmamedium
Trusted Path Bypass via Windows Directory Spoofing
sigmahigh
TrustedPath UAC Bypass Pattern
sigmacritical
UAC Bypass Abusing Winsat Path Parsing - File
sigmahigh
UAC Bypass Abusing Winsat Path Parsing - Process
sigmahigh
UAC Bypass Abusing Winsat Path Parsing - Registry
sigmahigh
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
elasticmedium
UAC Bypass Attempt via Privileged IFileOperation COM Interface
elastichigh
UAC Bypass Attempt via Windows Directory Masquerading
elastichigh
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
elastichigh
UAC Bypass MMC Load Unsigned Dll
splunk_escu
UAC Bypass Tools Using ComputerDefaults
sigmahigh
UAC Bypass Using .NET Code Profiler on MMC
sigmahigh
UAC Bypass Using ChangePK and SLUI
sigmahigh
UAC Bypass Using Consent and Comctl32 - File
sigmahigh
UAC Bypass Using Consent and Comctl32 - Process
sigmahigh
UAC Bypass Using Disk Cleanup
sigmahigh
UAC Bypass Using DismHost
sigmahigh
UAC Bypass Using IDiagnostic Profile
sigmahigh
UAC Bypass Using IDiagnostic Profile - File
sigmahigh
UAC Bypass Using IEInstal - File
sigmahigh
UAC Bypass Using IEInstal - Process
sigmahigh
UAC Bypass Using Iscsicpl - ImageLoad
sigmahigh
UAC Bypass Using MSConfig Token Modification - File
sigmahigh
UAC Bypass Using MSConfig Token Modification - Process
sigmahigh
UAC Bypass Using NTFS Reparse Point - File
sigmahigh
UAC Bypass Using NTFS Reparse Point - Process
sigmahigh
UAC Bypass Using PkgMgr and DISM
sigmahigh
UAC Bypass Using Windows Media Player - File
sigmahigh
UAC Bypass Using Windows Media Player - Process
sigmahigh
UAC Bypass Using Windows Media Player - Registry
sigmahigh
UAC Bypass Using WOW64 Logger DLL Hijack
sigmahigh
UAC Bypass via DiskCleanup Scheduled Task Hijack
elasticmedium
UAC Bypass via Event Viewer
sigmahigh
UAC Bypass via ICMLuaUtil
sigmahigh
UAC Bypass via ICMLuaUtil Elevated COM Interface
elastichigh
UAC Bypass via Sdclt
sigmahigh
UAC Bypass via Windows Firewall Snap-In Hijack
elasticmedium
UAC Bypass Via Wsreset
sigmahigh
UAC Bypass With Fake DLL
sigmahigh
UAC Bypass WSReset
sigmahigh
UAC Disabled
sigmamedium
UAC Notification Disabled
sigmamedium
UAC Secure Desktop Prompt Disabled
sigmamedium
Windows Bypass UAC via Pkgmgr Tool
splunk_escu
Windows ComputerDefaults Spawning a Process
splunk_escu
Windows DISM Install PowerShell Web Access
splunk_escu
Windows UAC Bypass Suspicious Child Process
splunk_escu
Windows UAC Bypass Suspicious Escalation Behavior
splunk_escu
WSReset UAC Bypass
splunk_escu