T1548.002

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)

Upon execution command prompt should be launched with administrative privileges. Supported Platforms: windows#### Attack Commands: Run with command_prompt

Upon execution command prompt should be launched with administrative privalages Supported Platforms: windows#### Attack Commands: Run with powershell

Upon execution, “The operation completed successfully.” will be shown twice and command prompt will be opened. Supported Platforms: windows#### Attack Commands: Run with command_prompt

Upon execution command prompt will be opened. Supported Platforms: windows#### Attack Commands: Run with powershell

Upon execution administrative command prompt should open Supported Platforms: windows#### Attack Commands: Run with powershell

Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with command_prompt

Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe Reference - sevagas.com Adapted from MITRE ATT&CK Evals Supported Platforms: windows#### Attack Commands: Run with powershell

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0 Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with command_prompt

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Leo Davidson derivative

Method: IFileOperation

Target: \system32\pkgmgr.exe

Component: DismCore.dll

Implementation: ucmDismMethod

UCM Method: UacMethodDISM

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Method: Registry key manipulation

Target: \system32\sdclt.exe

Component: Attacker defined

Implementation: ucmSdcltIsolatedCommandMethod

UCM Method: UacMethodShellSdclt

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Author: winscripting.blog

Method: Registry key manipulation

Target: \system32\fodhelper.exe

Component: Attacker defined

Implementation: ucmShellRegModMethod

UCM Method: UacMethodMsSettings2

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Author: James Forshaw

Method: Environment variables expansion

Target: \system32\svchost.exe via \system32\schtasks.exe

Component: Attacker defined

Implementation: ucmDiskCleanupEnvironmentVariable

UCM Method: UacMethodDiskSilentCleanup

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Stefan Kanthak

Method: .NET Code Profiler

Target: \system32\mmc.exe

Component: Attacker defined

Implementation: ucmCorProfilerMethod

UCM Method: UacMethodCorProfiler

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Method: Registry key manipulation

Target: \system32\WSReset.exe

Component: Attacker defined

Implementation: ucmShellRegModMethod

UCM Method: UacMethodShellWSReset

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Author: James Forshaw

Method: RAiLaunchAdminProcess and DebugObject

Target: Attacker defined

Component: Attacker defined

Implementation: ucmDebugObjectMethod

UCM Method: UacMethodDebugObject

Supported Platforms: windows

Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts. Note: The cleanup_command’s which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Enigma0x3/bytecode77 derivative by Nassim Asrir

Method: Registry key manipulation

Target: \system32\slui.exe, \system32\changepk.exe

Component: Attacker defined

Implementation: ucmShellRegModMethod

UCM Method: UacMethodDebugObject

Supported Platforms: windows

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin to 0.

MedusaLocker Ransomware , Purple Fox Rootkit , Avaddon Ransomware Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

This setting ensures that the elevation prompt is only used in secure desktop mode. Disable User Account Conrol (UAC) for secure desktop by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop to 0. Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with powershell

There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of Process Injection and unusual loaded DLLs through DLL Order Hijacking , which indicate attempts to gain access to higher privileged processes.

Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example:

The eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command Registry key.(Citation: enigma0x3 Fileless UAC Bypass)

The sdclt.exe bypass uses the [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe and [HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand Registry keys.(Citation: enigma0x3 sdclt app paths)(Citation: enigma0x3 sdclt bypass)

Analysts should monitor these Registry settings for unauthorized changes.