Skip to content
Threat Feed
Subscribe
high advisory

Windows User Account Control Bypass via Sdclt

The sdclt.exe utility can be abused for User Account Control (UAC) bypass through the manipulation of specific registry keys associated with the application's execution path.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Sources
3 public sources
Freshness
Revision 1Nov 13, 07:49 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Sdclt.exe is a Windows application that can be abused to perform a User Account Control (UAC) bypass. The technique involves modifying registry keys that the binary queries during execution. By manipulating these keys, an attacker can redirect the execution flow.

Attack Chain

  1. Manipulation of registry keys in the path of sdclt.exe.
  2. Execution of sdclt.exe, resulting in the triggering of an attacker-controlled path with elevated privileges.

Recommendation

Deploy the provided Sigma detection rule to monitor for registry modifications indicative of this technique.

Detection coverage 1

Detect UAC Bypass via Registry Manipulation of Sdclt.exe

high

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe.

sigma tactics: privilege-escalation techniques: T1548.002 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →