T1548.002Privilege Escalation
Bypass User Account Control
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
56 Sigma rules tagged T1548.002Bypass User Account ControlT1548.00256 general rules
- HackTool - Empire PowerShell UAC Bypasscriticalstable
- TrustedPath UAC Bypass Patterncriticaltest
- CMSTP UAC Bypass via COM Object Accesshighstable
- Bypass UAC Using DelegateExecutehightest
- Bypass UAC Using SilentCleanup Taskhightest
- Bypass UAC via CMSTPhightest
- Bypass UAC via Fodhelper.exehightest
- Bypass UAC via WSReset.exehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Bypass User Account Control
1 CVE, by priority. Each link shows its badge.- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reportsMITRE CTID mapping of the KEV entry · how it is exploited99.8%Top 0.04%87.6priority