Abuse Elevation Control Mechanism T1548

Events covered

19 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 120 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (45 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (444 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (75 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 65 rules

• Abused Debug Privilege by Arbitrary Parent Processes
• Always Install Elevated MSI Spawned Cmd And Powershell
• Always Install Elevated Windows Installer
• Bypass UAC Using DelegateExecute
• Bypass UAC Using SilentCleanup Task
• Bypass UAC via CMSTP
• Bypass UAC via Fodhelper.exe
• Bypass UAC via WSReset.exe
• CMSTP UAC Bypass via COM Object Access
• COM Hijack via Sdclt
• Credential Dumping Attempt Via Svchost
• Explorer NOUACCHECK Flag
• Function Call From Undocumented COM Interface EditionUpgradeManager
• HackTool - Empire PowerShell UAC Bypass
• HackTool - UACMe Akagi Execution
• HackTool - WinPwn Execution
• HackTool - WinPwn Execution - ScriptBlock
• Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
• Potential Privilege Escalation via Local Kerberos Relay over LDAP
• Potential UAC Bypass Via Sdclt.EXE
• Potentially Suspicious Event Viewer Child Process
• PowerShell Web Access Feature Enabled Via DISM
• Regedit as Trusted Installer
• Registry Modification of MS-settings Protocol Handler
• SCM Database Privileged Operation
• Sdclt Child Processes
• Shell Open Registry Keys Manipulation
• Sudo Privilege Escalation CVE-2019-14287
• Suspicious Shell Open Command Registry Modification
• Trusted Path Bypass via Windows Directory Spoofing
• TrustedPath UAC Bypass Pattern
• UAC Bypass Abusing Winsat Path Parsing - File
• UAC Bypass Abusing Winsat Path Parsing - Process
• UAC Bypass Abusing Winsat Path Parsing - Registry
• UAC Bypass Tools Using ComputerDefaults
• UAC Bypass Using .NET Code Profiler on MMC
• UAC Bypass Using ChangePK and SLUI
• UAC Bypass Using Consent and Comctl32 - File
• UAC Bypass Using Consent and Comctl32 - Process
• UAC Bypass Using Disk Cleanup
• UAC Bypass Using DismHost
• UAC Bypass Using IDiagnostic Profile
• UAC Bypass Using IDiagnostic Profile - File
• UAC Bypass Using IEInstal - File
• UAC Bypass Using IEInstal - Process
• UAC Bypass Using Iscsicpl - ImageLoad
• UAC Bypass Using MSConfig Token Modification - File
• UAC Bypass Using MSConfig Token Modification - Process
• UAC Bypass Using NTFS Reparse Point - File
• UAC Bypass Using NTFS Reparse Point - Process
• UAC Bypass Using PkgMgr and DISM
• UAC Bypass Using Windows Media Player - File
• UAC Bypass Using Windows Media Player - Process
• UAC Bypass Using Windows Media Player - Registry
• UAC Bypass Using WOW64 Logger DLL Hijack
• UAC Bypass via Event Viewer
• UAC Bypass via ICMLuaUtil
• UAC Bypass via Sdclt
• UAC Bypass via Windows Firewall Snap-In Hijack
• UAC Bypass Via Wsreset
• UAC Bypass With Fake DLL
• UAC Bypass WSReset
• UAC Disabled
• UAC Notification Disabled
• UAC Secure Desktop Prompt Disabled

Elastic 9 rules

• Bypass UAC via Event Viewer
• Disabling User Account Control via Registry Modification
• Local Account TokenFilter Policy Disabled
• UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
• UAC Bypass Attempt via Windows Directory Masquerading
• UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
• UAC Bypass via DiskCleanup Scheduled Task Hijack
• UAC Bypass via ICMLuaUtil Elevated COM Interface
• UAC Bypass via Windows Firewall Snap-In Hijack

Splunk 43 rules

• Allow Operation with Consent Admin
• ComputerDefaults UAC Bypass (PowerShell)
• ComputerDefaults UAC Bypass (Sysmon)
• ComputerDefaults UAC Bypass (Windows Event Log)
• ConsentPromptBehaviorAdmin Registry Value Modified (PowerShell)
• ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
• ConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log)
• Disable UAC Remote Restriction
• Disabling Remote User Account Control
• EnableLUA Registry Value Modified (PowerShell)
• EnableLUA Registry Value Modified (Sysmon)
• EnableLUA Registry Value Modified (Windows Event Log)
• Eventvwr UAC Bypass
• FodHelper UAC Bypass
• Indirect Command Execution (Sysmon)
• Indirect Command Execution (Windows Event Log)
• Mock System Directory - Windows (Sysmon)
• Mock System Directory - Windows (Windows Event Log)
• NET Profiler UAC bypass
• Potential fodhelper UAC Bypass Attempt (PowerShell)
• Potential fodhelper UAC Bypass Attempt (Sysmon)
• Potential fodhelper UAC Bypass Attempt (Windows Event Log)
• PromptOnSecureDesktop Registry Value Modified (PowerShell)
• PromptOnSecureDesktop Registry Value Modified (Sysmon)
• PromptOnSecureDesktop Registry Value Modified (Windows Event Log)
• Sdclt UAC Bypass
• Services Escalate Exe
• SilentCleanup UAC Bypass
• SLUI RunAs Elevated
• SLUI Spawning a Process
• Suspicious ComputerDefaults.exe Execution (Sysmon)
• Suspicious ComputerDefaults.exe Execution (Windows Event Log)
• UAC Bypass MMC Load Unsigned Dll
• Windows Bypass UAC via Pkgmgr Tool
• Windows ComputerDefaults Spawning a Process
• Windows DISM Install PowerShell Web Access
• Windows Mock Trusted Directory MSC File Creation
• Windows Privilege Escalation Suspicious Process Elevation
• Windows Privilege Escalation System Process Without System Parent
• Windows Privilege Escalation User Process Spawn System Process
• Windows UAC Bypass Suspicious Child Process
• Windows UAC Bypass Suspicious Escalation Behavior
• WSReset UAC Bypass

Kusto 3 rules

• Potential Fodhelper UAC Bypass
• Potential Fodhelper UAC Bypass (ASIM Version)
• Powershell Empire Cmdlets Executed in Command Line