Tool

github.com/hfiref0x/UACME

https://github.com/hfiref0x/UACME

Published on: github.com
Sources in this catalogue: 3

ATT&CK techniques those detections carry

T1548.002Bypass User Account Control
T1548Abuse Elevation Control Mechanism
T1559Inter-Process Communication
T1559.001Component Object Model
T1218.003CMSTP
T1546.001Change Default File Association
T1564.004NTFS File Attributes
T1574Hijack Execution Flow
+1 more

33 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
UAC Bypass Attempt via Privileged IFileOperation COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass via ICMLuaUtil Elevated COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Shell Open Registry Keys Manipulation	High	SigmaHQ	Sep 2, 2026	Detection Rule License 1.1
WSReset UAC Bypass	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
SilentCleanup UAC Bypass	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Sdclt UAC Bypass	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
UAC Bypass Using Windows Media Player - Registry	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Abusing Winsat Path Parsing - Registry	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass via Sdclt	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass WSReset	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using Windows Media Player - Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Abusing Winsat Path Parsing - Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using PkgMgr and DISM	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using NTFS Reparse Point - Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using MSConfig Token Modification - Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using IEInstal - Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using DismHost	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using Consent and Comctl32 - Process	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Tools Using ComputerDefaults	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
CMSTP UAC Bypass via COM Object Access	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using Disk Cleanup	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using ChangePK and SLUI	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
HackTool - UACMe Akagi Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
UAC Bypass Using WOW64 Logger DLL Hijack	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 25 of 33

Filter in the catalogue