Bypassing User Account Control (UAC)

Overview

Bypassing User Account Control (UAC) is a technique used by adversaries to elevate privileges on Windows systems without triggering standard security prompts. It plays a critical role in the attack lifecycle by enabling attackers to execute code with administrative rights, facilitating further compromise and persistence.

Attack Objective

• Gain elevated privileges to execute code with administrative rights
• Supports stages including Privilege Escalation, Execution, Persistence, and Defense Evasion
• Advances attacker control by circumventing security prompts and enabling stealthy privilege escalation

How the Technique Works

UAC bypass techniques exploit weaknesses in the Windows security model or trusted processes to execute code with elevated privileges without user consent. This is often achieved by manipulating auto-elevated executables, hijacking COM interfaces, or abusing system utilities that run with elevated rights by default.

Common Methods & Variations

• Exploitation of auto-elevated system binaries and trusted Windows components
• Use of COM object hijacking or registry manipulation to trigger elevated execution
• Variations across on-premises Windows endpoints and cloud-hosted Windows environments
• Combination of living-off-the-land binaries (LOLBins) and custom scripts or payloads

Indicators of Compromise (IOCs)

• Unusual execution of auto-elevated binaries or system utilities outside normal contexts
• Registry changes related to COM object or protocol handler hijacking
• Unexpected process creation with elevated privileges without corresponding UAC prompts
• Endpoint logs showing anomalous parent-child process relationships involving system binaries

Detection Strategies

• Monitoring process creation events and parent-child process relationships via endpoint telemetry
• Behavioral detection focusing on anomalous use of auto-elevated executables and COM objects
• Correlation of registry modifications with process execution to identify hijacking attempts
• Use of heuristic and anomaly detection to identify deviations from baseline user and system behavior

Mitigation & Prevention

• Enforce the principle of least privilege and minimize administrative account usage
• Configure UAC settings to the highest level to require consent for elevation
• Apply application whitelisting and restrict execution of untrusted binaries
• Regularly audit and harden registry permissions to prevent unauthorized modifications

Response Considerations

• Immediately isolate affected systems to prevent lateral movement
• Investigate process creation logs and registry changes to identify scope and method of bypass
• Remove persistence mechanisms and unauthorized elevated accounts or privileges
• Implement post-incident hardening, including UAC policy review and privilege management

Related Techniques

• Privilege Escalation via Exploitation of Vulnerabilities
• Living-off-the-Land Binaries and Scripts (LOLBins)
• Registry Run Keys / Startup Folder Persistence
• Process Injection and DLL Hijacking

Mapping & References

• MITRE ATT&CK Tactic: Privilege Escalation
• MITRE ATT&CK Technique: Bypass User Account Control (T1548.002)
• Public research and advisories on UAC bypass techniques from cybersecurity vendors and incident reports