ATT&CK coverage › Technique
Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Events covered
16 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 70 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (26 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (243 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 56 rules
- Always Install Elevated MSI Spawned Cmd And Powershell
- Always Install Elevated Windows Installer
- Bypass UAC Using DelegateExecute
- Bypass UAC Using SilentCleanup Task
- Bypass UAC via CMSTP
- Bypass UAC via Fodhelper.exe
- Bypass UAC via WSReset.exe
- CMSTP UAC Bypass via COM Object Access
- Explorer NOUACCHECK Flag
- Function Call From Undocumented COM Interface EditionUpgradeManager
- HackTool - Empire PowerShell UAC Bypass
- HackTool - UACMe Akagi Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Potential UAC Bypass Via Sdclt.EXE
- Potentially Suspicious Event Viewer Child Process
- PowerShell Web Access Feature Enabled Via DISM
- Registry Modification of MS-settings Protocol Handler
- Sdclt Child Processes
- Shell Open Registry Keys Manipulation
- Suspicious Shell Open Command Registry Modification
- Trusted Path Bypass via Windows Directory Spoofing
- TrustedPath UAC Bypass Pattern
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Abusing Winsat Path Parsing - Registry
- UAC Bypass Tools Using ComputerDefaults
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI
- UAC Bypass Using Consent and Comctl32 - File
- UAC Bypass Using Consent and Comctl32 - Process
- UAC Bypass Using Disk Cleanup
- UAC Bypass Using DismHost
- UAC Bypass Using IDiagnostic Profile
- UAC Bypass Using IDiagnostic Profile - File
- UAC Bypass Using IEInstal - File
- UAC Bypass Using IEInstal - Process
- UAC Bypass Using Iscsicpl - ImageLoad
- UAC Bypass Using MSConfig Token Modification - File
- UAC Bypass Using MSConfig Token Modification - Process
- UAC Bypass Using NTFS Reparse Point - File
- UAC Bypass Using NTFS Reparse Point - Process
- UAC Bypass Using PkgMgr and DISM
- UAC Bypass Using Windows Media Player - File
- UAC Bypass Using Windows Media Player - Process
- UAC Bypass Using Windows Media Player - Registry
- UAC Bypass Using WOW64 Logger DLL Hijack
- UAC Bypass via Event Viewer
- UAC Bypass via ICMLuaUtil
- UAC Bypass via Sdclt
- UAC Bypass Via Wsreset
- UAC Bypass With Fake DLL
- UAC Bypass WSReset
- UAC Disabled
- UAC Notification Disabled
- UAC Secure Desktop Prompt Disabled
Splunk 11 rules
- Disable UAC Remote Restriction
- Disabling Remote User Account Control
- Eventvwr UAC Bypass
- NET Profiler UAC bypass
- Sdclt UAC Bypass
- SilentCleanup UAC Bypass
- UAC Bypass MMC Load Unsigned Dll
- Windows ComputerDefaults Spawning a Process
- Windows DISM Install PowerShell Web Access
- Windows UAC Bypass Suspicious Escalation Behavior
- WSReset UAC Bypass