Procedure examples

UPPERCUT contains functionality to bypass UAC.

WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.

UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.

Sliver can leverage multiple techniques to bypass User Account Control (UAC) on Windows systems.

SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension.

Empire includes various modules to attempt to bypass UAC for escalation of privileges.

PoshC2 can utilize multiple methods to bypass UAC.

CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.

Remcos has a command for UAC bypassing.

Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.

Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.

QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.

Cobalt Strike can use sudo to run a command.

Proton modifies the tty_tickets line in the sudoers file.

Shai-Hulud has attempted to gain root access by leveraging `sudo` and `/etc/sudoers.d`.

Dok adds admin ALL=(ALL) NOPASSWD: ALL to the /etc/sudoers file.

TeamPCP Cloud Stealer can use `sudo` for code execution.

CanisterWorm has checked if the current user is root. If it is, CanisterWorm will wipe the system using `rm –rf / --no-preserve-root`. If it is not, CanisterWorm will try passwordless sudo and will run the same command.

OSX/Shlayer can escalate privileges to root by asking the user for credentials.

For several modules, XCSSET attempts to access or list the contents of user folders such as Desktop, Downloads, and Documents. If the folder does not exist or access is denied, it enters a loop where it resets the TCC database and retries access.

During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.

FoggyWeb can allow abuse of a compromised AD FS server's SAML token.

During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.

HAFNIUM has abused service principals with administrative permissions for data exfiltration.

APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.

CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.

Shai-Hulud has leveraged captured valid NPM tokens to enumerate and update packages on compromised accounts. Shai-Hulud has also utilized stolen GitHub access tokens to access compromised accounts.

Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.

Mini Shai-Hulud has the ability to authenticate using stolen application access tokens.

CanisterWorm has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.

TeamPCP has used stolen access tokens to inject malicious code into CI/CD workflows and to exfiltrate sensitive data from cloud, developer, and container environments.

ShinyHunters has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.

Kali365 has utilized an Exchange Admin module that captured admin tokens to create rogue mailbox connectors and change mail-flow rules.

During Operation Digital Eye, threat actors used a pass-the-hash capability to move laterally.

During the 2025 Poland Wiper Attacks, the adversaries attempted to reuse password hash values to gain access to other systems.

During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.

GALLIUM used dumped hashes to authenticate to other machines via pass the hash.

Kimsuky has used pass the hash for authentication to remote access software used in C2.

APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.

APT32 has used pass the hash for lateral movement.

Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.

The APT1 group is known to have used pass the hash.

Chimera has dumped password hashes for use in pass the hash authentication attacks.

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.

APT28 has used pass the hash for lateral movement.

Wizard Spider has used the `Invoke-SMBExec` PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.

FIN13 has used the PowerShell utility `Invoke-SMBExec` to execute the pass the hash method for lateral movement within an compromised environment.

BADHATCH can perform pass the hash on compromised machines with x64 versions.

HOPLIGHT has been observed loading several APIs associated with Pass the Hash.

Cobalt Strike can perform pass the hash.