Procedure examples

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.

Patchwork bypassed User Access Control (UAC).

Evilnum has used PowerShell to bypass UAC.

MuddyWater uses various techniques to bypass UAC.

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.

APT29 has bypassed UAC.

Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.

Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.

Cobalt Group has bypassed UAC.

A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.

RCSession can bypass UAC to escalate privileges.

Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.

Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.

An older variant of PLAINTEE performs UAC bypass.

Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.

BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.

WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.

InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.

Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.

Raspberry Robin will use the legitimate Windows utility fodhelper.exe to run processes at elevated privileges without requiring a User Account Control prompt.

BlackCat can bypass UAC to escalate privileges.

HTTPTroy has leveraged the ability to execute commands with system privileges using the `srun <EXECUTABLE> <ARGS>` command.

CHIMNEYSWEEP can make use of the Windows `SilentCleanup` scheduled task to execute its payload with elevated privileges.

BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.

ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.

Avaddon bypasses UAC using the CMSTPLUA COM interface.

Clambling has the ability to bypass UAC using a `passuac.dll` file.

DarkGate uses two distinct User Account Control (UAC) bypass techniques to escalate privileges.

LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.

Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges.

PipeMon installer can use UAC bypass techniques to install the payload.

KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to “AlwaysNotify".

Shamoon attempts to disable UAC remote restrictions by modifying the Registry.

RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.

Grandoreiro can bypass UAC by registering as the default handler for .MSC files.

Sakula contains UAC bypass code for both 32- and 64-bit systems.

LockBit 2.0 can bypass UAC through creating the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration`.

FinFisher performs UAC bypass.

Cobalt Strike can use a number of known techniques to bypass Windows UAC.

Ramsay can use UACMe for privilege escalation.

Lokibot has utilized multiple techniques to bypass UAC.

Winnti for Windows can use a variant of the sysprep UAC bypass.

KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.

Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.

AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.

Gelsemium can bypass UAC to elevate process privileges on a compromised host.

AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.

H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).

BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.