tool

UACMe S0116

Type: tool
Created: 31 May 2017
Last modified: 25 April 2025

UACMe is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0116

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2022-10-20	1e53dd56-8d83-4eb4-a43e-b790a05510aa
	This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	—	078235c5-6ec5-48e7-94b2-f8b5474379ea
	Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2024-12-01	cd951fdc-4b2f-47f5-ba99-a33bf61e3770
	Bypasses User Account Control using a fileless method	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	frack113	2022-01-05	2023-08-17	46dd5308-4572-4d12-aa43-8938f0184d4f
	Detects the setting of the environement variable "windir" to a non default value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	frack113, Nextron Systems	2022-01-06	2024-01-30	724ea201-6514-4f38-9739-e5973c34f49a
	Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install sp (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Stealth System Binary Proxy Execution CMSTP	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-08-30	e66779cc-383e-4224-a3a4-267eeb585c40
	Identifies use of Fodhelper.exe to bypass User Account Control. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	2019-10-24	2021-11-27	7f741dcf-fc22-4759-87b4-9ae8376676a2
	Detects use of WSReset.exe to bypass User Account Control (UAC). (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth	2019-10-24	2022-05-13	d797268e-28a9-49a7-b9a8-2f5039011c5c
	Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Stealth System Binary Proxy Execution CMSTP	-	high	Nik Seetharaman, Christian Burkard (Nextron Systems)	2019-07-31	2024-12-01	4b60e6f2-bf39-47b4-b4ea-398e33cfe253
Splunk	The following analytic detects the modification of the registry to disable UAC remote restriction by setting the "LocalAccountTokenFilterPolicy" value to "0x00000001". (...)	Generic	stable	registry_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-09-29	2026-05-13	9928b732-210e-11ec-b65e-acde48001122
Splunk	The following analytic identifies modifications to the registry key that controls the enforcement of Windows User Account Control (UAC). (...)	Generic	stable	registry_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	David Dorsey, Patrick Bareiss, Splunk	2020-04-29	2026-10-09	bbc644bc-37df-4e1a-9c88-ec9a53e2038c
Splunk	The following analytic detects an Eventvwr UAC bypass by identifying suspicious registry modifications in the path that Eventvwr.msc references upon execution. (...)	Generic	stable	registry_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Steven Dick, Michael Haag, Splunk	2021-03-01	2026-10-02	9cf8fe08-7ad8-11eb-9819-acde48001122
	Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub p (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Florian Roth (Nextron Systems)	2022-02-23	2022-04-21	534f2ef7-e8a2-4433-816d-c91bccde289b
Splunk	The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Persistence, Defense Impairment Modify Registry	-	medium	Michael Haag, Splunk	2021-03-01	2026-10-02	909f8fd8-7ac8-11eb-a1f3-acde48001122
	Detects function calls from the EditionUpgradeManager COM interface. (...)	Generic	test	process_access	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	oscd.community, Dmitry Uchakin	2020-10-07	2023-11-30	fb3722e4-1a06-46b6-b772-253e2e7db933
	Detects some Empire PowerShell UAC bypass methods	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	critical	Ecco	2019-08-30	2023-02-21	3268b746-88d8-4cd3-bffc-30077d02c787
	Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)	2021-08-30	2024-11-23	d38d2fa4-98e6-4a24-aff1-410b0c9ad177
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
	This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	—	38cf8340-461b-4857-bf99-23a41f772b18
Splunk	The following analytic detects modifications to the registry aimed at bypassing the User Account Control (UAC) feature in Windows. (...)	Generic	stable	registry_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teoderick Contreras, Splunk	2021-07-08	2026-05-13	0252ca80-e30d-11eb-8aa3-acde48001122
	A General detection for sdclt being spawned as an elevated process. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2024-12-01	40f9af16-589d-4984-b78d-8c2aec023197
	Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass a (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Florian Roth (Nextron Systems)	2017-03-19	2023-09-28	be344333-921d-4c4d-8bb8-e584cf584780
	Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Michael Haag	2024-09-03	—	7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f
	Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Persistence, Privilege Escalation Event Triggered Execution Change Default File Association Persistence, Defense Impairment Modify Registry	-	medium	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2021-12-20	2026-01-24	dd3ee8cc-f751-41c9-ba53-5a32ed47e563
	A General detection for sdclt spawning new processes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2021-11-27	da2738f2-fadb-4394-afa7-0a0674885afa
Splunk	The following analytic detects suspicious modifications to the sdclt.exe registry, a technique often used to bypass User Account Control (UAC). (...)	Generic	stable	registry_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Steven Dick, Teoderick Contreras, Splunk	2021-07-08	2026-05-13	d71efbf6-da63-11eb-8c6e-acde48001122
	Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile", which (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Persistence, Privilege Escalation Event Triggered Execution Change Default File Association	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2026-08-27	152f3630-77c1-4284-bcc0-4cc68ab2f6e7
Splunk	The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. (...)	Generic	stable	registry_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Steven Dick, Teoderick Contreras, Splunk	2021-07-08	2026-05-13	56d7cfcc-da63-11eb-92d4-acde48001122
Splunk	The following analytic detects the execution of the Microsoft Software Licensing User Interface Tool (`slui.exe`) with elevated privileges using the `-verb runas` function. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Michael Haag, Splunk	2021-05-13	2026-05-13	8d124810-b3e4-11eb-96c7-acde48001122
Splunk	The following analytic detects the Microsoft Software Licensing User Interface Tool (`slui.exe`) spawning a child process. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Michael Haag, Splunk	2021-05-13	2026-05-13	879c4330-b3e0-11eb-b1b1-acde48001122
	Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Persistence, Privilege Escalation Event Triggered Execution Change Default File Association	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-01-24	—	9e8894c0-0ae0-11ef-9d85-1f2942bec57c
	Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. (...)	Generic	experimental	image_load	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-06-17	—	0cbe38c0-270c-41d9-ab79-6e5a9a669290
	Detects indicators of a UAC bypass method by mocking directories	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	critical	Florian Roth (Nextron Systems)	2021-08-27	2025-06-17	4ac47ed3-44c2-4b1f-9d51-bf46e8914126
	Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)	Generic	test	file_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2022-10-09	155dbf56-e0a4-4dd0-8905-8a98705045e8
	Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2024-12-01	7a01183d-71a2-46ad-ad5c-acd989ac1793
	Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2023-08-17	6597be7b-ac61-4ac8-bef4-d3ec88174853
Splunk	The following analytic detects the loading of an unsigned DLL by the MMC.exe application, which is indicative of a potential UAC bypass or privilege escalation attempt. (...)	Generic	stable	image_load	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Stealth System Binary Proxy Execution MMC	-	medium	Teoderick Contreras, Splunk	2021-07-12	2026-05-13	7f04349c-e30d-11eb-bc7f-acde48001122
	Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-31	2024-12-01	3c05e90d-7eba-4324-9972-5d7f711a60a8
	Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)	Generic	test	file_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2022-10-09	93a19907-d4f9-4deb-9f91-aac4692776a6
	Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-23	2024-12-01	503d581c-7df0-4bbe-b9be-5840c0ecc1fc
	Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)	Generic	test	file_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-23	2022-10-09	62ed5b55-f991-406a-85d9-e8e8fdf18789
	Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-23	2024-12-01	1ca6bd18-0ba0-44ca-851c-92ed89a61085
	Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACM (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2024-12-01	b697e69c-746f-4a86-9f59-7bfff8eab881
	Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2024-12-01	853e74f9-9392-4935-ad3b-2e8c040dae86
	Detects the "IDiagnosticProfileUAC" UAC bypass technique	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-03	2024-12-01	4cbef972-f347-4170-b62a-8253f6168e6d
	Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC (...)	Generic	test	file_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-03	—	48ea844d-19b1-4642-944e-fe39c2cc1fec
	Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)	Generic	test	file_event	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2022-10-09	bdd8157d-8e85-4397-bb82-f06cc9c71dbb
	Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Christian Burkard (Nextron Systems)	2021-08-30	2024-12-01	80fc36aa-945e-4181-89f2-2f907ab6775d
	Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking techniqu (...)	Generic	test	image_load	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-17	2022-07-25	9ed5959a-c43c-4c59-84e3-d28628429456

Title

Description

UACMe S0116

UACMe MITRE reference S0116

Standing S0116

Reach

Coverage

UACMe detections S0116