Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1548.002

Bypass User Account Control

Privilege Escalation 87 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk Disabling Remote User Account Control production 2026-10-09
splunk FodHelper UAC Bypass production 2026-10-02
splunk Eventvwr UAC Bypass production 2026-10-02
elastic Local Account TokenFilter Policy Disabled production 2026-09-18
elastic UAC Bypass via DiskCleanup Scheduled Task Hijack production 2026-09-18
elastic UAC Bypass Attempt via Windows Directory Masquerading production 2026-09-18
elastic UAC Bypass Attempt via Privileged IFileOperation COM Interface production 2026-09-18
elastic Potential PowerShell HackTool Script by Function Names production 2026-09-18
elastic UAC Bypass via ICMLuaUtil Elevated COM Interface production 2026-09-18
elastic Bypass UAC via Event Viewer production 2026-09-18
elastic Disabling User Account Control via Registry Modification production 2026-09-18
elastic UAC Bypass via Windows Firewall Snap-In Hijack production 2026-09-18
elastic UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer production 2026-09-18
elastic UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface production 2026-09-18
sigma Shell Open Registry Keys Manipulation test 2026-08-27
splunk Windows Suspicious Child Process of Consent.EXE production 2026-07-30
splunk SLUI Spawning a Process production 2026-05-13
splunk SLUI RunAs Elevated production 2026-05-13
splunk SilentCleanup UAC Bypass production 2026-05-13
splunk Sdclt UAC Bypass production 2026-05-13
splunk NET Profiler UAC bypass production 2026-05-13
splunk Disable UAC Remote Restriction production 2026-05-13
splunk WSReset UAC Bypass production 2026-05-13
splunk Windows UAC Bypass Suspicious Escalation Behavior production 2026-05-13
splunk Windows UAC Bypass Suspicious Child Process production 2026-05-13
splunk Windows Mock Trusted Directory MSC File Creation production 2026-05-13
splunk Windows DISM Install PowerShell Web Access production 2026-05-13
splunk Windows ComputerDefaults Spawning a Process production 2026-05-13
splunk Windows Bypass UAC via Pkgmgr Tool production 2026-05-13
splunk UAC Bypass MMC Load Unsigned Dll production 2026-05-13
sigma Registry Modification of MS-settings Protocol Handler test 2026-01-24
sigma Suspicious Shell Open Command Registry Modification experimental 2026-01-24
sigma TrustedPath UAC Bypass Pattern test 2025-06-17
sigma Trusted Path Bypass via Windows Directory Spoofing experimental 2025-06-17
sigma UAC Bypass Using IDiagnostic Profile test 2024-12-01
sigma Always Install Elevated Windows Installer test 2024-12-01
sigma UAC Bypass Using ChangePK and SLUI test 2024-12-01
sigma UAC Bypass Using Disk Cleanup test 2024-12-01
sigma CMSTP UAC Bypass via COM Object Access stable 2024-12-01
sigma UAC Bypass Tools Using ComputerDefaults test 2024-12-01
sigma UAC Bypass Using Consent and Comctl32 - Process test 2024-12-01
sigma UAC Bypass Using DismHost test 2024-12-01
sigma UAC Bypass Using IEInstal - Process test 2024-12-01
sigma UAC Bypass Using MSConfig Token Modification - Process test 2024-12-01
sigma UAC Bypass Using NTFS Reparse Point - Process test 2024-12-01
sigma UAC Bypass Using PkgMgr and DISM test 2024-12-01
sigma Potential UAC Bypass Via Sdclt.EXE test 2024-12-01
sigma UAC Bypass Abusing Winsat Path Parsing - Process test 2024-12-01
sigma UAC Bypass Using Windows Media Player - Process test 2024-12-01
sigma UAC Bypass WSReset test 2024-12-01
sigma HackTool - UACMe Akagi Execution test 2024-11-23
sigma PowerShell Web Access Feature Enabled Via DISM test 2024-09-03
sigma UAC Secure Desktop Prompt Disabled test 2024-05-10
sigma UAC Notification Disabled test 2024-05-10
sigma UAC Disabled stable 2024-05-10
sigma Bypass UAC Using SilentCleanup Task test 2024-01-30
sigma HackTool - WinPwn Execution - ScriptBlock test 2023-12-04
sigma HackTool - WinPwn Execution test 2023-12-04
sigma Function Call From Undocumented COM Interface EditionUpgradeManager test 2023-11-30
sigma Potentially Suspicious Event Viewer Child Process test 2023-09-28
sigma UAC Bypass via Event Viewer test 2023-09-28
sigma UAC Bypass via Sdclt test 2023-08-17
sigma UAC Bypass Abusing Winsat Path Parsing - Registry test 2023-08-17
sigma UAC Bypass Using Windows Media Player - Registry test 2023-08-17
sigma Bypass UAC Using DelegateExecute test 2023-08-17
sigma HackTool - Empire PowerShell UAC Bypass stable 2023-02-21
sigma UAC Bypass With Fake DLL test 2022-12-25
sigma Always Install Elevated MSI Spawned Cmd And Powershell test 2022-10-20
sigma UAC Bypass Using MSConfig Token Modification - File test 2022-10-09
sigma UAC Bypass Using NTFS Reparse Point - File test 2022-10-09
sigma UAC Bypass Using Consent and Comctl32 - File test 2022-10-09
sigma UAC Bypass Abusing Winsat Path Parsing - File test 2022-10-09
sigma UAC Bypass Using WOW64 Logger DLL Hijack test 2022-10-09
sigma UAC Bypass Using Windows Media Player - File test 2022-10-09
sigma UAC Bypass Using .NET Code Profiler on MMC test 2022-10-09
sigma UAC Bypass Using IEInstal - File test 2022-10-09
sigma UAC Bypass via ICMLuaUtil test 2022-09-27
sigma Bypass UAC via CMSTP test 2022-08-30
elastic Potential Privilege Escalation via Local Kerberos Relay over LDAP deprecated 2022-08-01
sigma UAC Bypass Using Iscsicpl - ImageLoad test 2022-07-25
sigma UAC Bypass Using IDiagnostic Profile - File test 2022-07-03
sigma Bypass UAC via WSReset.exe test 2022-05-13
sigma Explorer NOUACCHECK Flag test 2022-04-21
sigma Sdclt Child Processes test 2021-11-27
sigma UAC Bypass Via Wsreset test 2021-11-27
sigma Bypass UAC via Fodhelper.exe test 2021-11-27
sentinel Potential Fodhelper UAC Bypass (ASIM Version) Scheduled —