Home
ATT&CK Techniques
T1548.002 Bypass User Account Control

T1548.002 Bypass User Account Control

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

<code>eventvwr.exe</code> can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
PR.IR-01.05	Remote access protection	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access. References
PR.IR-01.06	Production environment segregation	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise. References
PR.AA-05.02	Privileged system access	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement protects against Bypass User Account Control through the use of privileged account management and the use of multi-factor authentication. References
DE.CM-06.02	Third-party access monitoring	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement protects against Bypass User Account Control through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems. References
PR.PS-02.01	Patch identification and application	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement is related to the implementation of a patch management program. Applying patches and upgrades for products and systems provided by vendors mitigates the risk of adversaries exploiting known vulnerabilities. For example, updating Windows to the latest version and patch level provides the latest protective measures against UAC bypass. References
PR.PS-01.03	Configuration deviation	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement provides protection from Abuse Elevation Control Mechanism: Bypass User Account Control through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baseline configuration of the Operating System and integrity checking can help protect against adversaries attempting to compromise and elevate privileges. References
DE.CM-03.03	Privileged account monitoring	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement implements mechanisms and tools to mitigate potential misuse of privileged users and accounts. Continuous monitoring of role and attribute assignments and activity is essential to prevent and detect unauthorized access or misuse. References
PR.AA-01.01	Identity and credential management	Mitigates	T1548.002	Bypass User Account Control	Comments This diagnostic statement protects against Bypass User Account Control through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts. References

NIST 800-53 Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
CM-06	Configuration Settings	mitigates	T1548.002	Bypass User Account Control
CM-05	Access Restrictions for Change	mitigates	T1548.002	Bypass User Account Control
SI-02	Flaw Remediation	mitigates	T1548.002	Bypass User Account Control
RA-05	Vulnerability Monitoring and Scanning	mitigates	T1548.002	Bypass User Account Control
CM-02	Baseline Configuration	mitigates	T1548.002	Bypass User Account Control
CM-02	Baseline Configuration	mitigates	T1548.002	Bypass User Account Control
IA-02	Identification and Authentication (Organizational Users)	mitigates	T1548.002	Bypass User Account Control
SI-04	System Monitoring	mitigates	T1548.002	Bypass User Account Control
AC-02	Account Management	mitigates	T1548.002	Bypass User Account Control
AC-03	Access Enforcement	mitigates	T1548.002	Bypass User Account Control
AC-05	Separation of Duties	mitigates	T1548.002	Bypass User Account Control
AC-06	Least Privilege	mitigates	T1548.002	Bypass User Account Control

VERIS Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
action.hacking.variety.Abuse of functionality	Abuse of functionality.	related-to	T1548.002	Bypass User Account Control
action.hacking.variety.Exploit misconfig	Exploit a misconfiguration (vs vuln or weakness)	related-to	T1548.002	Bypass User Account Control
action.malware.variety.Exploit misconfig	Exploit a misconfiguration (vs vuln or weakness)	related-to	T1548.002	Bypass User Account Control

Azure Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
file_integrity_monitoring	Microsoft Defender for Cloud: File Integrity Monitoring	technique_scores	T1548.002	Bypass User Account Control	Comments Some UAC bypass methods rely on modifying specific, user-accessible Registry settings that can be monitored using this control. Overall, there are numerous other bypass methods that do not result in Registry modification that this control will not be effective in detection resulting in a low detection coverage factor. References https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview
alerts_for_windows_machines	Alerts for Windows Machines	technique_scores	T1548.002	Bypass User Account Control	Comments This control may detect when User Account Control is bypassed by manipulating the Windows registry. There may be other methods to Bypass User Account Control which limits the score to Minimal. The following alerts may be generated: "Detected change to a registry key that can be abused to bypass UAC" References https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines

GCP Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
google_secops	Google Security Operations	technique_scores	T1548.002	Bypass User Account Control	Comments Google Security Ops is able to trigger an alert based on system-level processes and other modifications to MacOS platforms (e.g., "FILE_MODIFICATION", "chflags hidden"). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/mitre_attack/T1564_001_macos_hidden_files_and_directories.yaral References ['https://cloud.google.com/security/products/security-operations' 'https://cloud.google.com/chronicle/docs/secops/secops-overview' 'https://github.com/chronicle/detection-rules']
policy_intelligence	Policy Intelligence	technique_scores	T1548.002	Bypass User Account Control	Comments Adversaries may bypass UAC mechanisms to elevate process privileges. This control can be used to help enforce least privilege principals to ensure that permission levels are properly managed. Along with this, Policy Analyzer lets users know what principals have access to resources based on its corresponding IAM allow policies. References ['https://cloud.google.com/policy-intelligence']