T1548.002 Bypass User Account Control — ATT&CK Technique

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box. An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as: * eventvwr.exe can auto-elevate and execute a specified binary or script. Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.

Detection coverage (50)

UAC Bypass Using IEInstal - File high
UAC Bypass Using Consent and Comctl32 - File high
UAC Bypass Using .NET Code Profiler on MMC high
UAC Bypass Using IDiagnostic Profile - File high
UAC Bypass Using MSConfig Token Modification - File high
UAC Bypass Using NTFS Reparse Point - File high
UAC Bypass Using Windows Media Player - File high
UAC Bypass Abusing Winsat Path Parsing - File high
Trusted Path Bypass via Windows Directory Spoofing high
UAC Bypass With Fake DLL high
UAC Bypass Using Iscsicpl - ImageLoad high
HackTool - WinPwn Execution - ScriptBlock high
UAC Bypass Using WOW64 Logger DLL Hijack high
Function Call From Undocumented COM Interface EditionUpgradeManager medium
HackTool - UACMe Akagi Execution high
PowerShell Web Access Feature Enabled Via DISM high
Potentially Suspicious Event Viewer Child Process high
Explorer NOUACCHECK Flag high
HackTool - Empire PowerShell UAC Bypass critical
HackTool - WinPwn Execution high
Sdclt Child Processes medium
Always Install Elevated Windows Installer medium
Always Install Elevated MSI Spawned Cmd And Powershell medium
Registry Modification of MS-settings Protocol Handler medium
UAC Bypass Using Disk Cleanup high
UAC Bypass Using DismHost high
UAC Bypass Using IDiagnostic Profile high
Potential UAC Bypass Via Sdclt.EXE medium
UAC Bypass WSReset high
UAC Bypass Tools Using ComputerDefaults high
UAC Bypass Using NTFS Reparse Point - Process high
UAC Bypass Using Windows Media Player - Process high
Bypass UAC via CMSTP high
UAC Bypass Using IEInstal - Process high
TrustedPath UAC Bypass Pattern critical
CMSTP UAC Bypass via COM Object Access high
Bypass UAC via Fodhelper.exe high
UAC Bypass Using MSConfig Token Modification - Process high
UAC Bypass Abusing Winsat Path Parsing - Process high
UAC Bypass Using ChangePK and SLUI high
UAC Bypass Using Consent and Comctl32 - Process high
UAC Bypass via ICMLuaUtil high
UAC Bypass Using PkgMgr and DISM high
Bypass UAC via WSReset.exe high
UAC Bypass Via Wsreset high
Shell Open Registry Keys Manipulation high
Bypass UAC Using DelegateExecute high
Bypass UAC Using SilentCleanup Task high
UAC Bypass Abusing Winsat Path Parsing - Registry high
UAC Disabled medium

Malware using this technique

Threat actors using this technique

Read the full analysis on IntelFusions