Technique:  Abuse Elevation Control Mechanism:Bypass User Account Control
AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.
It has bypassed UAC.
It has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.
AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.
Avaddon bypasses UAC using the CMSTPLUA COM interface.
Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.
BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.
BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.
BlackCat can bypass UAC to escalate privileges.
BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.
It has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.
Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.
Clambling has the ability to bypass UAC using a passuac.dll file.
It has bypassed UAC.
Cobalt Strike can use a number of known techniques to bypass Windows UAC.
CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.
Downdelph bypasses UAC to escalate privileges by using a custom "RedirectEXE" shim database.
It has used the Fodhelper UAC bypass technique to gain elevated privileges.
Empire includes various modules to attempt to bypass UAC for escalation of privileges.
It has used PowerShell to bypass UAC.
FinFisher performs UAC bypass.
Gelsemium can bypass UAC to elevate process privileges on a compromised host.
Grandoreiro can bypass UAC by registering as the default handler for .MSC files.
H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).
InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.
Koadic has 2 methods for elevating integrity. It can bypass UAC through eventvwr.exe and sdclt.exe.
KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.
KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to "AlwaysNotify".
Lokibot has utilized multiple techniques to bypass UAC.
It uses various techniques to bypass UAC.
During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and cliconfig.exe to bypass UAC protections.
It bypassed User Access Control (UAC).
PipeMon installer can use UAC bypass techniques to install the payload.
An older variant of PLAINTEE performs UAC bypass.
PoshC2 can utilize multiple methods to bypass UAC.
Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.
QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.
Ramsay can use UACMe for privilege escalation.
RCSession can bypass UAC to escalate privileges.
Remcos has a command for UAC bypassing.
It can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.
Saint Bot has attempted to bypass UAC using fodhelper.exe to escalate privileges.
Sakula contains UAC bypass code for both 32- and 64-bit systems.
Shamoon attempts to disable UAC remote restrictions by modifying the Registry.
ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.
SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the .msc file extension.
A It tool can use a public UAC bypass method to elevate privileges.
UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.
WarzoneRAT can use sdclt.exe to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.
WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.
Winnti for Windows can use a variant of the sysprep UAC bypass.
Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.