Which SIEM platforms have a T1548.002 detection rule?

df00tech provides T1548.002 (Bypass User Account Control) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Bypass User Account Control (T1548.002)?

Detecting Bypass User Account Control requires the following data sources: Process: Process Creation, Windows Registry: Registry Value Modification, Microsoft Defender for Endpoint.

What severity and confidence is the T1548.002 detection?

The T1548.002 detection is rated high severity with high confidence.

What are common false positives for T1548.002?

Common false positives for T1548.002 include: Legitimate administrative tools that invoke auto-elevating binaries (some vendor software uses eventvwr.exe legitimately); IT management software that uses CMSTP/COM elevation for authorized software deployment; Pentest tools performing authorized UAC bypass testing on test endpoints.

T1548.002 IBM QRadar · QRadar

Detect Bypass User Account Control in IBM QRadar

Adversaries bypass Windows User Account Control (UAC) to execute code with elevated privileges without triggering user prompts. Common methods include: eventvwr.exe hijacking (ZeroT, Koadic), fodhelper.exe Registry key abuse (Saint Bot), sdclt.exe App Paths abuse (WarzoneRAT), CMSTPLUA COM interface (Avaddon), and DLL hijacking via auto-elevated applications (ShimRat via migwiz.exe). Used by BlackCat, LockBit 2.0/3.0, Cobalt Strike, DarkGate, Evilnum, APT37, APT38, BRONZE BUTLER, and many others. UACME documents 70+ bypass methods.

MITRE ATT&CK

Tactic: Privilege Escalation Defense Evasion
Technique: T1548 Abuse Elevation Control Mechanism
Sub-technique: T1548.002 Bypass User Account Control
Canonical reference: https://attack.mitre.org/techniques/T1548/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  "CommandLine",
  "ParentCommandLine",
  "Image",
  "ParentImage",
  "TargetObject",
  CASE
    WHEN LOWER("ParentImage") MATCHES '.*\\(eventvwr|fodhelper|sdclt|cmstp|migwiz|wsreset|computerdefaults|slui|pkgmgr|sysprep|osk|msconfig|mmc|eudcedit|charmap|colorcpl)\.exe$'
      AND NOT LOWER("Image") MATCHES '.*\\(conhost|WerFault|dwm)\.exe$'
      AND QIDNAME(qid) LIKE '%Process Create%'
      THEN 'UAC_Auto_Elevate_Child_Spawn'
    WHEN (LOWER("TargetObject") LIKE '%\\Software\\Classes\\ms-settings%'
      OR LOWER("TargetObject") LIKE '%\\Software\\Classes\\mscfile%'
      OR LOWER("TargetObject") LIKE '%\\Classes\\exefile\\shell\\runas%'
      OR LOWER("TargetObject") LIKE '%\\App Paths\\control.exe%')
      AND LOWER("TargetObject") LIKE '%hkcu%'
      THEN 'UAC_Bypass_Registry_HKCU'
    WHEN LOWER("Image") LIKE '%\\cmstp.exe'
      OR (LOWER("Image") LIKE '%\\dllhost.exe' AND "CommandLine" LIKE '%3E5FC7F9-9A51-4367-9063-A120244FBEC7%')
      THEN 'UAC_CMSTPLUA_COM_Elevation'
    ELSE NULL
  END AS detection_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND devicetime > DATEADD('hour', -24, NOW())
  AND (
    (
      LOWER("ParentImage") MATCHES '.*\\(eventvwr|fodhelper|sdclt|cmstp|migwiz|wsreset|computerdefaults|slui|pkgmgr|sysprep|osk|msconfig)\.exe$'
      AND NOT LOWER("Image") MATCHES '.*\\(conhost|WerFault|dwm)\.exe$'
    )
    OR (
      (LOWER("TargetObject") LIKE '%ms-settings%' OR LOWER("TargetObject") LIKE '%mscfile%'
        OR LOWER("TargetObject") LIKE '%exefile%runas%' OR LOWER("TargetObject") LIKE '%App Paths%control%')
      AND LOWER("TargetObject") LIKE '%hkcu%'
    )
    OR LOWER("Image") LIKE '%\\cmstp.exe'
    OR (LOWER("Image") LIKE '%\\dllhost.exe' AND "CommandLine" LIKE '%3E5FC7F9-9A51-4367-9063-A120244FBEC7%')
  )
ORDER BY devicetime DESC

high severity medium confidence

AQL query for QRadar that correlates Sysmon or Windows Security event log data to detect UAC bypass patterns: auto-elevating binaries spawning unexpected child processes, HKCU registry key manipulation at known UAC bypass paths, and CMSTPLUA COM interface abuse via cmstp.exe or dllhost.exe with the CMSTPLUA CLSID argument.

Data Sources

Microsoft Windows Security Event LogSysmon via QRadar DSMWindows Sysmon

Required Tables

events

False Positives & Tuning

Enterprise software deployment tools (SCCM, Intune) that legitimately write to App Paths or ms-settings registry locations during managed installs
Windows OS upgrade processes (e.g., Windows Anytime Upgrade, Feature Updates) that use migwiz.exe or sysprep.exe and spawn helper child processes
Legitimate administrative scripts run by IT staff that call computerdefaults.exe or wsreset.exe during workstation provisioning or troubleshooting

Download portable Sigma rule (.yml)

Other platforms for T1548.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1UAC Bypass via eventvwr.exe (Registry Hijacking)
Expected signal: Sysmon EventCode 13: RegistryValueSet at HKCU\Software\Classes\mscfile\shell\open\command. Sysmon EventCode 1: eventvwr.exe process, followed by calc.exe (or cmd.exe) spawned with High integrity level. Security Event 4688 for calc.exe with high integrity.
Test 2UAC Bypass via fodhelper.exe (ms-settings)
Expected signal: Sysmon EventCode 12/13: HKCU\Software\Classes\ms-settings\shell\open\command created with cmd.exe value. Sysmon EventCode 1: fodhelper.exe spawning cmd.exe with High integrity level.
Test 3Check UAC Configuration and Current Integrity Level
Expected signal: Sysmon EventCode 1: reg.exe and whoami.exe process creation.

Last updated: 2026-04-20 Research depth: deep

References (6)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1548.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Bypass User Account Control in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1548.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Privilege Escalation

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1548.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Privilege Escalation

Popular Detections

Get new detections in your inbox