T1548.002 · Bypass User Account Control

T1548.002 · Bypass User Account Control · Sunturai

attack-patternenterprise-attackT1548.002

Bypass User Account Control

attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works) If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows) Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as: * eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit) Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)

Created: Jan 30, 2020, 2:24 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

86 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
UAC Bypass via Windows Firewall Snap-In Hijack	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
UAC Bypass Attempt via Windows Directory Masquerading	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Bypass UAC via Event Viewer	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
UAC Bypass Attempt via Privileged IFileOperation COM Interface	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
UAC Bypass via DiskCleanup Scheduled Task Hijack	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
UAC Bypass via ICMLuaUtil Elevated COM Interface	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Disabling User Account Control via Registry Modification	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Local Account TokenFilter Policy Disabled	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Potential Privilege Escalation via Local Kerberos Relay over LDAP	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
WSReset UAC Bypass	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows UAC Bypass Suspicious Escalation Behavior	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows UAC Bypass Suspicious Child Process	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Suspicious Child Process of Consent.EXE	Informational	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Mock Trusted Directory MSC File Creation	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows DISM Install PowerShell Web Access	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows ComputerDefaults Spawning a Process	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Bypass UAC via Pkgmgr Tool	Informational	Splunk security content	Aug 26, 2026	Apache-2.0
UAC Bypass MMC Load Unsigned Dll	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
SLUI Spawning a Process	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
SLUI RunAs Elevated	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
SilentCleanup UAC Bypass	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Sdclt UAC Bypass	Medium	Splunk security content	Aug 26, 2026	Apache-2.0

Showing 25 of 86

Filter in the catalogue

External references

mitre-attackT1548.002Open reference

Davidson Windows

TechNet How UAC WorksOpen reference

SANS UAC Bypass

MSDN COM ElevationOpen reference

enigma0x3 Fileless UAC BypassOpen reference

TechNet Inside UACOpen reference

Fortinet FareitOpen reference

Github UACMeOpen reference

Platforms

Windows

Kill chain phases

privilege-escalation

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object