Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002

Events covered

17 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 106 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (36 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (743 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (63 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 56 rules

• Always Install Elevated MSI Spawned Cmd And Powershell
• Always Install Elevated Windows Installer
• Bypass UAC Using DelegateExecute
• Bypass UAC Using SilentCleanup Task
• Bypass UAC via CMSTP
• Bypass UAC via Fodhelper.exe
• Bypass UAC via WSReset.exe
• CMSTP UAC Bypass via COM Object Access
• Explorer NOUACCHECK Flag
• Function Call From Undocumented COM Interface EditionUpgradeManager
• HackTool - Empire PowerShell UAC Bypass
• HackTool - UACMe Akagi Execution
• HackTool - WinPwn Execution
• HackTool - WinPwn Execution - ScriptBlock
• Potential UAC Bypass Via Sdclt.EXE
• Potentially Suspicious Event Viewer Child Process
• PowerShell Web Access Feature Enabled Via DISM
• Registry Modification of MS-settings Protocol Handler
• Sdclt Child Processes
• Shell Open Registry Keys Manipulation
• Suspicious Shell Open Command Registry Modification
• Trusted Path Bypass via Windows Directory Spoofing
• TrustedPath UAC Bypass Pattern
• UAC Bypass Abusing Winsat Path Parsing - File
• UAC Bypass Abusing Winsat Path Parsing - Process
• UAC Bypass Abusing Winsat Path Parsing - Registry
• UAC Bypass Tools Using ComputerDefaults
• UAC Bypass Using .NET Code Profiler on MMC
• UAC Bypass Using ChangePK and SLUI
• UAC Bypass Using Consent and Comctl32 - File
• UAC Bypass Using Consent and Comctl32 - Process
• UAC Bypass Using Disk Cleanup
• UAC Bypass Using DismHost
• UAC Bypass Using IDiagnostic Profile
• UAC Bypass Using IDiagnostic Profile - File
• UAC Bypass Using IEInstal - File
• UAC Bypass Using IEInstal - Process
• UAC Bypass Using Iscsicpl - ImageLoad
• UAC Bypass Using MSConfig Token Modification - File
• UAC Bypass Using MSConfig Token Modification - Process
• UAC Bypass Using NTFS Reparse Point - File
• UAC Bypass Using NTFS Reparse Point - Process
• UAC Bypass Using PkgMgr and DISM
• UAC Bypass Using Windows Media Player - File
• UAC Bypass Using Windows Media Player - Process
• UAC Bypass Using Windows Media Player - Registry
• UAC Bypass Using WOW64 Logger DLL Hijack
• UAC Bypass via Event Viewer
• UAC Bypass via ICMLuaUtil
• UAC Bypass via Sdclt
• UAC Bypass Via Wsreset
• UAC Bypass With Fake DLL
• UAC Bypass WSReset
• UAC Disabled
• UAC Notification Disabled
• UAC Secure Desktop Prompt Disabled

Elastic 11 rules

• Bypass UAC via Event Viewer
• Disabling User Account Control via Registry Modification
• Local Account TokenFilter Policy Disabled
• Potential PowerShell HackTool Script by Function Names
• UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
• UAC Bypass Attempt via Privileged IFileOperation COM Interface
• UAC Bypass Attempt via Windows Directory Masquerading
• UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
• UAC Bypass via DiskCleanup Scheduled Task Hijack
• UAC Bypass via ICMLuaUtil Elevated COM Interface
• UAC Bypass via Windows Firewall Snap-In Hijack

Splunk 36 rules

• ComputerDefaults UAC Bypass (PowerShell)
• ComputerDefaults UAC Bypass (Sysmon)
• ComputerDefaults UAC Bypass (Windows Event Log)
• ConsentPromptBehaviorAdmin Registry Value Modified (PowerShell)
• ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
• ConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log)
• Disable UAC Remote Restriction
• Disabling Remote User Account Control
• EnableLUA Registry Value Modified (PowerShell)
• EnableLUA Registry Value Modified (Sysmon)
• EnableLUA Registry Value Modified (Windows Event Log)
• Eventvwr UAC Bypass
• FodHelper UAC Bypass
• Mock System Directory - Windows (Sysmon)
• Mock System Directory - Windows (Windows Event Log)
• NET Profiler UAC bypass
• Potential fodhelper UAC Bypass Attempt (PowerShell)
• Potential fodhelper UAC Bypass Attempt (Sysmon)
• Potential fodhelper UAC Bypass Attempt (Windows Event Log)
• PromptOnSecureDesktop Registry Value Modified (PowerShell)
• PromptOnSecureDesktop Registry Value Modified (Sysmon)
• PromptOnSecureDesktop Registry Value Modified (Windows Event Log)
• Sdclt UAC Bypass
• SilentCleanup UAC Bypass
• SLUI RunAs Elevated
• SLUI Spawning a Process
• Suspicious ComputerDefaults.exe Execution (Sysmon)
• Suspicious ComputerDefaults.exe Execution (Windows Event Log)
• UAC Bypass MMC Load Unsigned Dll
• Windows Bypass UAC via Pkgmgr Tool
• Windows ComputerDefaults Spawning a Process
• Windows DISM Install PowerShell Web Access
• Windows Mock Trusted Directory MSC File Creation
• Windows UAC Bypass Suspicious Child Process
• Windows UAC Bypass Suspicious Escalation Behavior
• WSReset UAC Bypass

Kusto 3 rules

• Potential Fodhelper UAC Bypass
• Potential Fodhelper UAC Bypass (ASIM Version)
• Powershell Empire Cmdlets Executed in Command Line