MITRE ATT&CKsub-technique

T1548.002 Bypass User Account Control

Published 2020-01-30 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Privilege Escalation
Platforms
Windows
Version
3.0
Created
2020-01-30

Description

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box. An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as: • eventvwr.exe can auto-elevate and execute a specified binary or script. Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1548 Abuse Elevation Control Mechanism technique

Tactic · MITRE ATT&CK (1)

  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1047 Audit mitigation
  • M1051 Update Software mitigation
  • M1052 User Account Control mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (64)

  • S9050 Vidar software (malware)
  • S9007 HTTPTroy software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1111 DarkGate software (malware)
  • S1081 BADHATCH software (malware)
  • S1068 BlackCat software (malware)
  • C0006 Operation Honeybee campaign
  • S1039 Bumblebee software (malware)
  • G1006 Earth Lusca group
  • S1018 Saint Bot software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0670 WarzoneRAT software (malware)
  • S0669 KOCTOPUS software (malware)
  • S0666 Gelsemium software (malware)
  • S0662 RCSession software (malware)
  • S0660 Clambling software (malware)
  • S0640 Avaddon software (malware)
  • S0633 Sliver software (tool)
  • S0612 WastedLocker software (malware)
  • S0584 AppleJeus software (malware)
  • S0606 Bad Rabbit software (malware)
  • S0570 BitPaymer software (malware)
  • G0120 Evilnum group
  • S0531 Grandoreiro software (malware)
  • S0527 CSPY Downloader software (tool)
Show all 64 ›

Referenced by Compliance · mitigates (15)

  • CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References