{"id":"T1548.002","name":"Bypass User Account Control","url":"https://attack.mitre.org/techniques/T1548/002","tactics":["privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0388","stix_id":"x-mitre-detection-strategy--d6619253-10cd-4b90-84b5-364c418d2484","name":"Detection Strategy for T1548.002 – Bypass User Account Control (UAC)","url":"https://attack.mitre.org/detectionstrategies/DET0388","analytics":[{"id":"AN1094","stix_id":"x-mitre-analytic--13a875c4-87d2-448e-a46e-970e1f9ad5da","name":"Analytic 1094","description":"Detects a multi-event behavior chain involving UAC bypass attempts via known auto-elevated binaries (e.g., eventvwr.exe, sdclt.exe), unauthorized Registry changes to UAC-related keys, and anomalous process execution with elevated privileges but lacking standard parent-child lineage. Suspicious patterns include invocation of auto-elevated COM objects or manipulation of isolatedCommand Registry entries without consent prompts.","url":"https://attack.mitre.org/detectionstrategies/DET0388#AN1094","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4672","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlate registry tampering and elevation within a tunable time window (e.g., 30 seconds) to reduce noise from benign admin activity."},{"field":"ElevatedProcessNameList","description":"Tunable list of suspicious elevated binaries (e.g., sdclt.exe, eventvwr.exe, computerdefaults.exe) known to support UAC bypass."},{"field":"ParentProcessAnomalyThreshold","description":"Define logic for parent-child mismatch (e.g., non-elevated process spawning auto-elevated one) to flag uncommon elevation paths."}],"live":true,"detection_strategies":["DET0388"],"techniques":["T1548.002"]}],"live":true,"version":"1.0","techniques":["T1548.002"]}],"sigma_rules":[{"id":"0058b9e5-bcd7-40d4-9205-95ca5a16d7b2","title":"UAC Bypass Using Windows Media Player - Process","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml","techniques":["T1548.002"],"cves":[]},{"id":"0cbe38c0-270c-41d9-ab79-6e5a9a669290","title":"Trusted Path Bypass via Windows Directory Spoofing","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-17","modified":null,"description":"Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g \"C:\\Windows \\System32\") which can bypass Windows trusted path verification.\nThis technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.\n","references":["https://x.com/Wietze/status/1933495426952421843"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.007","attack.t1548.002"],"path":"rules/windows/image_load/image_load_win_trusted_path_bypass.yml","techniques":["T1574.007","T1548.002"],"cves":[]},{"id":"0d7ceeef-3539-4392-8953-3dc664912714","title":"UAC Secure Desktop Prompt Disabled","author":"frack113","status":"test","level":"medium","date":"2024-05-10","modified":null,"description":"Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the \"PromptOnSecureDesktop\" value.\nThe \"PromptOnSecureDesktop\" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts.\nWhen \"PromptOnSecureDesktop\" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_uac_disable_secure_desktop_prompt.yml","techniques":["T1548.002"],"cves":[]},{"id":"152f3630-77c1-4284-bcc0-4cc68ab2f6e7","title":"Shell Open Registry Keys Manipulation","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-01-13","description":"Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)","references":["https://github.com/hfiref0x/UACME","https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/","https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass","https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1548.002","attack.t1546.001"],"path":"rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml","techniques":["T1548.002","T1546.001"],"cves":[]},{"id":"155dbf56-e0a4-4dd0-8905-8a98705045e8","title":"UAC Bypass Abusing Winsat Path Parsing - File","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_winsat.yml","techniques":["T1548.002"],"cves":[]},{"id":"1ca6bd18-0ba0-44ca-851c-92ed89a61085","title":"UAC Bypass Using Consent and Comctl32 - Process","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml","techniques":["T1548.002"],"cves":[]},{"id":"1e53dd56-8d83-4eb4-a43e-b790a05510aa","title":"Always Install Elevated MSI Spawned Cmd And Powershell","author":"Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community","status":"test","level":"medium","date":"2020-10-13","modified":"2022-10-20","description":"Detects Windows Installer service (msiexec.exe) spawning \"cmd\" or \"powershell\"","references":["https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml","techniques":["T1548.002"],"cves":[]},{"id":"3268b746-88d8-4cd3-bffc-30077d02c787","title":"HackTool - Empire PowerShell UAC Bypass","author":"Ecco","status":"stable","level":"critical","date":"2019-08-30","modified":"2023-02-21","description":"Detects some Empire PowerShell UAC bypass methods","references":["https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002","car.2019-04-001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml","techniques":["T1548.002"],"cves":[]},{"id":"39ed3c80-e6a1-431b-9df3-911ac53d08a7","title":"UAC Bypass Using NTFS Reparse Point - Process","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml","techniques":["T1548.002"],"cves":[]},{"id":"3c05e90d-7eba-4324-9972-5d7f711a60a8","title":"UAC Bypass Tools Using ComputerDefaults","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-31","modified":"2024-12-01","description":"Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml","techniques":["T1548.002"],"cves":[]},{"id":"40f9af16-589d-4984-b78d-8c2aec023197","title":"Potential UAC Bypass Via Sdclt.EXE","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2024-12-01","description":"A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/6","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml","techniques":["T1548.002"],"cves":[]},{"id":"41bb431f-56d8-4691-bb56-ed34e390906f","title":"UAC Bypass Using MSConfig Token Modification - File","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml","techniques":["T1548.002"],"cves":[]},{"id":"46dd5308-4572-4d12-aa43-8938f0184d4f","title":"Bypass UAC Using DelegateExecute","author":"frack113","status":"test","level":"high","date":"2022-01-05","modified":"2023-08-17","description":"Bypasses User Account Control using a fileless method","references":["https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand","https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml","techniques":["T1548.002"],"cves":[]},{"id":"48437c39-9e5f-47fb-af95-3d663c3f2919","title":"UAC Disabled","author":"frack113","status":"stable","level":"medium","date":"2022-01-05","modified":"2024-05-10","description":"Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value \"EnableLUA\" to 0.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_uac_disable.yml","techniques":["T1548.002"],"cves":[]},{"id":"48ea844d-19b1-4642-944e-fe39c2cc1fec","title":"UAC Bypass Using IDiagnostic Profile - File","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-03","modified":null,"description":"Detects the creation of a file by \"dllhost.exe\" in System32 directory part of \"IDiagnosticProfileUAC\" UAC bypass technique","references":["https://github.com/Wh04m1001/IDiagnosticProfileUAC"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml","techniques":["T1548.002"],"cves":[]},{"id":"49f2f17b-b4c8-4172-a68b-d5bf95d05130","title":"UAC Bypass via ICMLuaUtil","author":"Florian Roth (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-09-13","modified":"2022-09-27","description":"Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface","references":["https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml","techniques":["T1548.002"],"cves":[]},{"id":"4ac47ed3-44c2-4b1f-9d51-bf46e8914126","title":"TrustedPath UAC Bypass Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-08-27","modified":"2025-06-17","description":"Detects indicators of a UAC bypass method by mocking directories","references":["https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e","https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows","https://github.com/netero1010/TrustedPath-UACBypass-BOF","https://x.com/Wietze/status/1933495426952421843"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml","techniques":["T1548.002"],"cves":[]},{"id":"4b60e6f2-bf39-47b4-b4ea-398e33cfe253","title":"CMSTP UAC Bypass via COM Object Access","author":"Nik Seetharaman, Christian Burkard (Nextron Systems)","status":"stable","level":"high","date":"2019-07-31","modified":"2024-12-01","description":"Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)","references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/","https://twitter.com/hFireF0X/status/897640081053364225","https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf","https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1548.002","attack.t1218.003","attack.g0069","car.2019-04-001"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml","techniques":["T1548.002","T1218.003"],"cves":[]},{"id":"4cbef972-f347-4170-b62a-8253f6168e6d","title":"UAC Bypass Using IDiagnostic Profile","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-03","modified":"2024-12-01","description":"Detects the \"IDiagnosticProfileUAC\" UAC bypass technique","references":["https://github.com/Wh04m1001/IDiagnosticProfileUAC"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml","techniques":["T1548.002"],"cves":[]},{"id":"4f6c43e2-f989-4ea5-bcd8-843b49a0317c","title":"UAC Bypass Using WOW64 Logger DLL Hijack","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml","techniques":["T1548.002"],"cves":[]},{"id":"503d581c-7df0-4bbe-b9be-5840c0ecc1fc","title":"UAC Bypass Using ChangePK and SLUI","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2024-12-01","description":"Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)","references":["https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b","https://github.com/hfiref0x/UACME","https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml","techniques":["T1548.002"],"cves":[]},{"id":"534f2ef7-e8a2-4433-816d-c91bccde289b","title":"Explorer NOUACCHECK Flag","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-23","modified":"2022-04-21","description":"Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks","references":["https://twitter.com/ORCA6665/status/1496478087244095491"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml","techniques":["T1548.002"],"cves":[]},{"id":"5b872a46-3b90-45c1-8419-f675db8053aa","title":"UAC Bypass via Sdclt","author":"Omer Yampel, Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2017-03-17","modified":"2023-08-17","description":"Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)","references":["https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/","https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002","car.2019-04-001"],"path":"rules/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml","techniques":["T1548.002"],"cves":[]},{"id":"5f9db380-ea57-4d1e-beab-8a2d33397e93","title":"UAC Bypass Using Windows Media Player - Registry","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2023-08-17","description":"Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml","techniques":["T1548.002"],"cves":[]},{"id":"62ed5b55-f991-406a-85d9-e8e8fdf18789","title":"UAC Bypass Using Consent and Comctl32 - File","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml","techniques":["T1548.002"],"cves":[]},{"id":"6597be7b-ac61-4ac8-bef4-d3ec88174853","title":"UAC Bypass Abusing Winsat Path Parsing - Registry","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2023-08-17","description":"Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml","techniques":["T1548.002"],"cves":[]},{"id":"68578b43-65df-4f81-9a9b-92f32711a951","title":"UAC Bypass Using Windows Media Player - File","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_wmp.yml","techniques":["T1548.002"],"cves":[]},{"id":"6ea3bf32-9680-422d-9f50-e90716b12a66","title":"UAC Bypass Via Wsreset","author":"oscd.community, Dmitry Uchakin","status":"test","level":"high","date":"2020-10-07","modified":"2021-11-27","description":"Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.","references":["https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly","https://lolbas-project.github.io/lolbas/Binaries/Wsreset"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml","techniques":["T1548.002"],"cves":[]},{"id":"724ea201-6514-4f38-9739-e5973c34f49a","title":"Bypass UAC Using SilentCleanup Task","author":"frack113, Nextron Systems","status":"test","level":"high","date":"2022-01-06","modified":"2024-01-30","description":"Detects the setting of the environement variable \"windir\" to a non default value.\nAttackers often abuse this variable in order to trigger a UAC bypass via the \"SilentCleanup\" task.\nThe SilentCleanup task located in %windir%\\system32\\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task","https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/","https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml","techniques":["T1548.002"],"cves":[]},{"id":"7a01183d-71a2-46ad-ad5c-acd989ac1793","title":"UAC Bypass Abusing Winsat Path Parsing - Process","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml","techniques":["T1548.002"],"cves":[]},{"id":"7c81fec3-1c1d-43b0-996a-46753041b1b6","title":"UAC Bypass via Event Viewer","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-19","modified":"2023-09-28","description":"Detects UAC bypass method using Windows event viewer","references":["https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/","https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002","car.2019-04-001"],"path":"rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml","techniques":["T1548.002"],"cves":[]},{"id":"7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f","title":"PowerShell Web Access Feature Enabled Via DISM","author":"Michael Haag","status":"test","level":"high","date":"2024-09-03","modified":null,"description":"Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse","references":["https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature","https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a","https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml","techniques":["T1548.002"],"cves":[]},{"id":"7f741dcf-fc22-4759-87b4-9ae8376676a2","title":"Bypass UAC via Fodhelper.exe","author":"E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2021-11-27","description":"Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.","references":["https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml","techniques":["T1548.002"],"cves":[]},{"id":"7fff6773-2baa-46de-a24a-b6eec1aba2d1","title":"UAC Bypass Using NTFS Reparse Point - File","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml","techniques":["T1548.002"],"cves":[]},{"id":"80fc36aa-945e-4181-89f2-2f907ab6775d","title":"UAC Bypass Using IEInstal - Process","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml","techniques":["T1548.002"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"853e74f9-9392-4935-ad3b-2e8c040dae86","title":"UAC Bypass Using DismHost","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml","techniques":["T1548.002"],"cves":[]},{"id":"89a9a0e0-f61a-42e5-8957-b1479565a658","title":"UAC Bypass WSReset","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config","references":["https://lolbas-project.github.io/lolbas/Binaries/Wsreset/","https://github.com/hfiref0x/UACME","https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml","techniques":["T1548.002"],"cves":[]},{"id":"93a19907-d4f9-4deb-9f91-aac4692776a6","title":"UAC Bypass Using .NET Code Profiler on MMC","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml","techniques":["T1548.002"],"cves":[]},{"id":"9e8894c0-0ae0-11ef-9d85-1f2942bec57c","title":"Suspicious Shell Open Command Registry Modification","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-01-24","modified":null,"description":"Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence.\nGenerally, modifications to the `*\\shell\\open\\command` registry key can indicate an attempt to change the default action for opening files,\nand various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.\n","references":["https://www.trendmicro.com/en_us/research/25/f/water-curse.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1548.002","attack.t1546.001"],"path":"rules/windows/registry/registry_set/registry_set_susp_shell_open_keys_modification_patterns.yml","techniques":["T1548.002","T1546.001"],"cves":[]},{"id":"9ed5959a-c43c-4c59-84e3-d28628429456","title":"UAC Bypass Using Iscsicpl - ImageLoad","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-17","modified":"2022-07-25","description":"Detects the \"iscsicpl.exe\" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%","references":["https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC","https://twitter.com/wdormann/status/1547583317410607110"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml","techniques":["T1548.002"],"cves":[]},{"id":"a5ea83a7-05a5-44c1-be2e-addccbbd8c03","title":"UAC Bypass With Fake DLL","author":"oscd.community, Dmitry Uchakin","status":"test","level":"high","date":"2020-10-06","modified":"2022-12-25","description":"Attempts to load dismcore.dll after dropping it","references":["https://steemit.com/utopian-io/@ah101/uac-bypassing-utility"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1548.002","attack.t1574.001"],"path":"rules/windows/image_load/image_load_uac_bypass_via_dism.yml","techniques":["T1548.002","T1574.001"],"cves":[]},{"id":"a743ceba-c771-4d75-97eb-8a90f7f4844c","title":"UAC Bypass Using PkgMgr and DISM","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml","techniques":["T1548.002"],"cves":[]},{"id":"ad92e3f9-7eb6-460e-96b1-582b0ccbb980","title":"UAC Bypass Using MSConfig Token Modification - Process","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml","techniques":["T1548.002"],"cves":[]},{"id":"b697e69c-746f-4a86-9f59-7bfff8eab881","title":"UAC Bypass Using Disk Cleanup","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-12-01","description":"Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml","techniques":["T1548.002"],"cves":[]},{"id":"bdd8157d-8e85-4397-bb82-f06cc9c71dbb","title":"UAC Bypass Using IEInstal - File","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2022-10-09","description":"Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml","techniques":["T1548.002"],"cves":[]},{"id":"be344333-921d-4c4d-8bb8-e584cf584780","title":"Potentially Suspicious Event Viewer Child Process","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-19","modified":"2023-09-28","description":"Detects uncommon or suspicious child processes of \"eventvwr.exe\" which might indicate a UAC bypass attempt","references":["https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/","https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002","car.2019-04-001"],"path":"rules/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml","techniques":["T1548.002"],"cves":[]},{"id":"c5f6a85d-b647-40f7-bbad-c10b66bab038","title":"UAC Notification Disabled","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-05-10","modified":null,"description":"Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the \"UACDisableNotify\" value.\nUAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users.\nWhen \"UACDisableNotify\" is set to 1, UAC prompts are suppressed.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md","https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/registry/registry_set/registry_set_uac_disable_notification.yml","techniques":["T1548.002"],"cves":[]},{"id":"cd951fdc-4b2f-47f5-ba99-a33bf61e3770","title":"Always Install Elevated Windows Installer","author":"Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community","status":"test","level":"medium","date":"2020-10-13","modified":"2024-12-01","description":"Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege","references":["https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml","techniques":["T1548.002"],"cves":[]},{"id":"d38d2fa4-98e6-4a24-aff1-410b0c9ad177","title":"HackTool - UACMe Akagi Execution","author":"Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-08-30","modified":"2024-11-23","description":"Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata","references":["https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_hktl_uacme.yml","techniques":["T1548.002"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"d797268e-28a9-49a7-b9a8-2f5039011c5c","title":"Bypass UAC via WSReset.exe","author":"E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth","status":"test","level":"high","date":"2019-10-24","modified":"2022-05-13","description":"Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.","references":["https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html","https://lolbas-project.github.io/lolbas/Binaries/Wsreset/","https://www.activecyber.us/activelabs/windows-uac-bypass","https://twitter.com/ReaQta/status/1222548288731217921"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml","techniques":["T1548.002"],"cves":[]},{"id":"da2738f2-fadb-4394-afa7-0a0674885afa","title":"Sdclt Child Processes","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2021-11-27","description":"A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/6","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml","techniques":["T1548.002"],"cves":[]},{"id":"dd3ee8cc-f751-41c9-ba53-5a32ed47e563","title":"Registry Modification of MS-settings Protocol Handler","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-12-20","modified":"2026-01-24","description":"Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.\nAttackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.\n","references":["https://thedfirreport.com/2021/12/13/diavol-ransomware/","https://www.trendmicro.com/en_us/research/25/f/water-curse.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.defense-impairment","attack.t1548.002","attack.t1546.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml","techniques":["T1548.002","T1546.001","T1112"],"cves":[]},{"id":"e66779cc-383e-4224-a3a4-267eeb585c40","title":"Bypass UAC via CMSTP","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2022-08-30","description":"Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files","references":["https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md","https://lolbas-project.github.io/lolbas/Binaries/Cmstp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1548.002","attack.t1218.003"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml","techniques":["T1548.002","T1218.003"],"cves":[]},{"id":"fb3722e4-1a06-46b6-b772-253e2e7db933","title":"Function Call From Undocumented COM Interface EditionUpgradeManager","author":"oscd.community, Dmitry Uchakin","status":"test","level":"medium","date":"2020-10-07","modified":"2023-11-30","description":"Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.","references":["https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/","https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.privilege-escalation","attack.t1548.002"],"path":"rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml","techniques":["T1548.002"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-31207","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}