type: attack-pattern
spec_version: 2.1
id: attack-pattern--ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be
created: 2017-05-31T21:31:07.462Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1088
external_id: T1088
source_name: TechNet How UAC Works
description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.
url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works
source_name: TechNet Inside UAC
description: Russinovich, M. (2009, July). User Account Control: Inside Windows 7 User Account Control. Retrieved July 26, 2016.
url: https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx
source_name: MSDN COM Elevation
description: Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July 26, 2016.
url: https://msdn.microsoft.com/en-us/library/ms679687.aspx
source_name: Davidson Windows
description: Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November 12, 2014.
url: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
source_name: Github UACMe
description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
url: https://github.com/hfiref0x/UACME
source_name: enigma0x3 Fileless UAC Bypass
description: Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe and Registry Hijacking. Retrieved December 27, 2016.
url: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
source_name: Fortinet Fareit
description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware
source_name: SANS UAC Bypass
description: Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June 3, 2016.
url: http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass
source_name: enigma0x3 sdclt app paths
description: Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved May 25, 2017.
url: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
source_name: enigma0x3 sdclt bypass
description: Nelson, M. (2017, March 17). "Fileless" UAC Bypass Using sdclt.exe. Retrieved May 25, 2017.
url: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:22.963Z
name: Bypass User Account Control
description: Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. (Citation: Davidson Windows) Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected.

Many methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods (Citation: Github UACMe) that have been discovered and implemented within UACMe, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

* eventvwr.exe can auto-elevate and execute a specified binary or script. (Citation: enigma0x3 Fileless UAC Bypass) (Citation: Fortinet Fareit)

Another bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity. (Citation: SANS UAC Bypass)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Stefan Kanthak
Casey Smith
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.1