Detecting and Mitigating UAC Bypass on Windows (T1548.002)

User Account Control (UAC) is the Windows feature that lets a program ask for higher privileges, tracked as integrity levels from low to high, and sometimes prompts the user to confirm. MITRE tracks attempts to get around it as T1548.002, Bypass User Account Control, a Privilege Escalation technique on Windows.

How attackers use it

The impact of UAC to a user ranges from a flat denial at the highest enforcement level, to a prompt the user can click through if they are a local administrator, to a password prompt for an administrator account.

The weakness MITRE highlights is the setting. If the UAC protection level is anything but the highest, certain Windows programs can elevate, or run elevated Component Object Model (COM) objects, without showing the user a notification. That is called auto-elevation.

MITRE gives a few shapes this takes.

• Loading a specially crafted DLL through rundll32 that loads an auto-elevated COM object and performs a file operation in a protected directory that would normally need elevated access.
• Injecting malicious software into a trusted process to gain elevated privileges without a prompt.
• Abusing programs that auto-elevate and can be told to run a chosen binary or script. MITRE gives eventvwr.exe as an example of a binary that can auto-elevate and execute a specified binary or script.

The page also points to a public project that catalogs many bypass methods, and notes new ones are found regularly, with some used in the wild.

One more path is not a flaw in UAC itself. UAC is a single system security mechanism, so the integrity of a process on one machine is unknown on a remote system, which defaults to high integrity. If credentials for an account with administrator rights are known, some lateral movement techniques arrive with high integrity by design. MITRE lists many malware families and groups with UAC bypass in their procedure examples, which shows how routine the step is.

How to detect it

MITRE's detection strategy describes a multi-event chain rather than one event.

• Use of known auto-elevated binaries, with eventvwr.exe and sdclt.exe named as examples.
• Unauthorized registry changes to UAC related keys, including manipulation of isolatedCommand entries.
• Elevated execution with no standard parent and child lineage, or without the consent prompt that should have come first.
• Invocation of auto-elevated COM objects.

In practice that means process creation logging with parent process and integrity level, plus registry auditing of the per-user class keys that auto-elevated programs read. A high integrity process whose parent is an auto-elevating binary that has no business starting it is the signal.

How to reduce the risk

MITRE lists four mitigations.

• Audit: check for common UAC bypass weaknesses on Windows systems so you know your exposure and can address issues.
• Privileged Account Management: remove users from the local administrator group on systems.
• Update Software: keep Windows at the latest version and patch level to benefit from current protections against bypass.
• User Account Control: although bypass techniques exist, use the highest enforcement level where possible, and close bypass opportunities such as DLL planting.

Removing standing local administrator rights helps most. A user who is not an administrator has no auto-elevation to abuse.

Check your own environment

Read-only commands for a Windows command prompt.

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
net localgroup Administrators

• EnableLUA should be 0x1.
• ConsentPromptBehaviorAdmin tells you the prompt behavior for administrators. Compare it with your policy.
• The Administrators list should hold only the accounts you expect. Look for domain users who appear on many machines.

Quick check

Sources

• MITRE ATT&CK, Abuse Elevation Control Mechanism: Bypass User Account Control: https://attack.mitre.org/techniques/T1548/002