{
  "family": "bypassuac",
  "sample_count": 145,
  "category": "trojan_tool",
  "description": "Behavior:Win32/BypassUAC is a critical heuristic detection for malware or attack frameworks that actively exploit design flaws or vulnerabilities in the Windows User Account Control (UAC) mechanism to silently elevate privileges from a standard user to a local Administrator.<br><br><b>Understanding BypassUAC</b><br>For the end-user, this behavior is invisible—the screen does not dim, and no prompt asking for 'Yes/No' administrator approval appears. For an incident responder, a BypassUAC alert means the attacker has successfully compromised the entire machine. By bypassing the prompt, the malware can now silently disable Windows Defender, install rootkits, or dump LSASS memory to steal domain credentials.<br><br><b>Execution and Evasion Strategies</b><br>BypassUAC is not a specific malware family, but a technique heavily utilized by advanced trojans (like Trickbot or Emotet) and penetration testing frameworks (like Metasploit and Cobalt Strike). Common techniques include 'Auto-Elevated COM Objects' (exploiting trusted Windows binaries like <code>eventvwr.exe</code> or <code>sdclt.exe</code> that automatically run as admin without prompting) and 'DLL Hijacking' (placing a malicious DLL in a specific path where an auto-elevating process will load it). The attacker drops the payload, triggers the trusted Windows binary, and the payload executes with elevated privileges.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise. Threat hunters should look for anomalous execution of administrative tools (e.g., <code>pkgmgr.exe</code>, <code>ComputerDefaults.exe</code>, <code>fodhelper.exe</code>) immediately followed by the spawning of an unknown child process or a command shell. EDR platforms detect this by monitoring for DLLs being written to system paths immediately prior to the execution of auto-elevating binaries.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1574.001",
    "T1112",
    "T1548.002",
    "T1055",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1548.002",
      "name": "Abuse Elevation Control Mechanism: Bypass User Account Control",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1574.001",
      "name": "Hijack Execution Flow: DLL Search Order Hijacking",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; a successful UAC bypass means the attacker has full administrative control and is likely moving laterally.",
    "Capture a full memory image to identify what payload was executed with the elevated privileges.",
    "Enforce the 'Always Notify' setting for UAC via Group Policy across the domain to mitigate automated bypass techniques.",
    "Assume total machine compromise; rebuild the operating system and force a password reset for the local user and any cached domain accounts."
  ],
  "what_to_avoid": [
    "Do not assume the user clicked 'Yes' to a prompt; UAC bypasses are entirely silent and automated by the malware.",
    "Avoid relying solely on local AV after a bypass; the attacker has the privileges to whitelist their own tools or disable the AV entirely."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}