Skip to content
Threat Feed

Tag

Uac-Bypass

6 briefs RSS
high advisory

UAC Bypass Attempt via Windows Directory Masquerading

Detects attempts to bypass User Account Control (UAC) by masquerading as a trusted Microsoft Windows directory, abusing a trailing-space in the path to execute code with elevated privileges.

Elastic Endpoint +4 privilege-escalation uac-bypass windows
2r 1t
high advisory

UAC Bypass via Event Viewer

Detects User Account Control (UAC) bypass attempts using eventvwr.exe to execute code with elevated permissions by identifying child processes of eventvwr.exe, excluding mmc.exe and WerFault.exe, which may indicate unauthorized privilege escalation.

Microsoft Defender XDR +3 privilege-escalation uac-bypass windows
2r 1t
high advisory

UAC Bypass via ICMLuaUtil Elevated COM Interface

Detects User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface, where attackers may attempt to stealthily execute code with elevated permissions, potentially leading to privilege escalation.

Elastic Defend +2 privilege-escalation uac-bypass windows
2r 1t
medium advisory

UAC Bypass via Windows Firewall MMC Snap-In Hijack

Attackers bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in to execute code with elevated permissions, potentially leading to system compromise.

Windows uac-bypass privilege-escalation windows-firewall mmc
2r 2t
medium advisory

UAC Bypass via DiskCleanup Scheduled Task Hijack

Attackers bypass User Account Control (UAC) by hijacking the DiskCleanup Scheduled Task to stealthily execute code with elevated permissions on Windows systems.

Defender XDR +1 uac-bypass privilege-escalation windows diskcleanup scheduled-task
2r 3t
medium advisory

UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer

This threat brief details a UAC bypass technique leveraging the Internet Explorer Add-On Installer (ieinstal.exe) and Component Object Model (COM) to execute arbitrary code with elevated privileges.

Microsoft Defender XDR +2 uac-bypass privilege-escalation com ieinstal
2r 3t