Detect Bypass User Account Control in Splunk
Adversaries bypass Windows User Account Control (UAC) to execute code with elevated privileges without triggering user prompts. Common methods include: eventvwr.exe hijacking (ZeroT, Koadic), fodhelper.exe Registry key abuse (Saint Bot), sdclt.exe App Paths abuse (WarzoneRAT), CMSTPLUA COM interface (Avaddon), and DLL hijacking via auto-elevated applications (ShimRat via migwiz.exe). Used by BlackCat, LockBit 2.0/3.0, Cobalt Strike, DarkGate, Evilnum, APT37, APT38, BRONZE BUTLER, and many others. UACME documents 70+ bypass methods.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.002 Bypass User Account Control
- Canonical reference
- https://attack.mitre.org/techniques/T1548/002/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval detection_type=case(
EventCode=1 AND
match(ParentImage, "(?i)(eventvwr|fodhelper|sdclt|cmstp|migwiz|wsreset|computerdefaults|slui|pkgmgr|sysprep|osk|msconfig)\.exe") AND
NOT match(Image, "(?i)(conhost|WerFault|dwm)\.exe"),
"UAC_Auto_Elevate_Child_Spawn",
EventCode IN (12,13) AND
(match(TargetObject, "(?i)(ms-settings|mscfile|exefile.*runas|App.Paths.*control)") AND
match(TargetObject, "(?i)HKCU")),
"UAC_Bypass_Registry_HKCU",
EventCode=1 AND
(match(Image, "(?i)cmstp\.exe") OR
(match(Image, "(?i)dllhost\.exe") AND match(CommandLine, "3E5FC7F9-9A51-4367-9063-A120244FBEC7"))),
"UAC_CMSTPLUA_COM_Elevation",
EventCode=1 AND
match(Image, "(?i)(powershell|cmd)\.exe") AND
match(ParentImage, "(?i)(eventvwr|fodhelper|sdclt)\.exe"),
"UAC_Bypass_Shell_Spawn",
true(), null()
)
| where isnotnull(detection_type)
| eval integrity_level=case(
match(Mandatory_Label, "(?i)High"), "High",
match(Mandatory_Label, "(?i)Medium"), "Medium",
true(), "Unknown"
)
| table _time, host, User, detection_type, Image, CommandLine, ParentImage, TargetObject, Details
| sort - _timeDetects UAC bypass via Sysmon with four detection patterns. Auto-elevating binary child spawns (EventCode 1) cover eventvwr, fodhelper, sdclt and other known bypass vehicles. HKCU registry modification at UAC bypass paths (EventCodes 12/13) cover registry hijacking methods. CMSTPLUA COM elevation pattern (EventCode 1) covers COM-based bypasses. Direct shell spawn from bypass binaries is the highest-fidelity signal.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate admin tools invoking auto-elevating system utilities
- Vendor software using COM elevation with administrative consent
- Authorized penetration testing in known test environments
Other platforms for T1548.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1UAC Bypass via eventvwr.exe (Registry Hijacking)
Expected signal: Sysmon EventCode 13: RegistryValueSet at HKCU\Software\Classes\mscfile\shell\open\command. Sysmon EventCode 1: eventvwr.exe process, followed by calc.exe (or cmd.exe) spawned with High integrity level. Security Event 4688 for calc.exe with high integrity.
- Test 2UAC Bypass via fodhelper.exe (ms-settings)
Expected signal: Sysmon EventCode 12/13: HKCU\Software\Classes\ms-settings\shell\open\command created with cmd.exe value. Sysmon EventCode 1: fodhelper.exe spawning cmd.exe with High integrity level.
- Test 3Check UAC Configuration and Current Integrity Level
Expected signal: Sysmon EventCode 1: reg.exe and whoami.exe process creation.
References (6)
- https://attack.mitre.org/techniques/T1548/002/
- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
- https://github.com/hfiref0x/UACME
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1548.002 including response playbook, investigation guide, and atomic red team tests.