Detect Bypass User Account Control in Sumo Logic CSE
Adversaries bypass Windows User Account Control (UAC) to execute code with elevated privileges without triggering user prompts. Common methods include: eventvwr.exe hijacking (ZeroT, Koadic), fodhelper.exe Registry key abuse (Saint Bot), sdclt.exe App Paths abuse (WarzoneRAT), CMSTPLUA COM interface (Avaddon), and DLL hijacking via auto-elevated applications (ShimRat via migwiz.exe). Used by BlackCat, LockBit 2.0/3.0, Cobalt Strike, DarkGate, Evilnum, APT37, APT38, BRONZE BUTLER, and many others. UACME documents 70+ bypass methods.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.002 Bypass User Account Control
- Canonical reference
- https://attack.mitre.org/techniques/T1548/002/
Sumo Detection Query
// Part 1: UAC bypass via auto-elevating binary child process spawn
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| where EventID = 1
| parse field=ParentImage "*\\*" as _parent_path, ParentBinary
| parse field=Image "*\\*" as _img_path, ChildBinary
| where toLowerCase(ParentBinary) in ("eventvwr.exe", "fodhelper.exe", "sdclt.exe", "cmstp.exe", "migwiz.exe", "wsreset.exe", "computerdefaults.exe", "slui.exe", "pkgmgr.exe", "sysprep.exe", "osk.exe", "msconfig.exe", "mmc.exe", "eudcedit.exe", "charmap.exe", "colorcpl.exe")
| where !(toLowerCase(ChildBinary) in ("conhost.exe", "werfault.exe", "dwm.exe"))
| fields _messageTime, Computer, User, ParentBinary, ChildBinary, CommandLine, ParentCommandLine
| concat ("UAC_Auto_Elevate_Bypass:", ParentBinary, " -> ", ChildBinary) as detection_label
// Part 2: UAC bypass registry key modifications
_sourceCategory=windows/sysmon
| where EventID in (12, 13)
| where TargetObject matches /(?i)(HKCU.*ms-settings|HKCU.*mscfile|HKCU.*exefile.*runas|HKCU.*App.Paths.*control)/
| fields _messageTime, Computer, User, TargetObject, Details, Image, CommandLine
| "UAC_Bypass_Registry_HKCU" as detection_label
// Part 3: CMSTPLUA COM interface elevation
_sourceCategory=windows/sysmon
| where EventID = 1
| where (toLowerCase(Image) matches /.*\\cmstp\.exe$/) OR
(toLowerCase(Image) matches /.*\\dllhost\.exe$/ AND CommandLine matches /3E5FC7F9-9A51-4367-9063-A120244FBEC7/)
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage
| "UAC_CMSTPLUA_COM_Elevation" as detection_labelSumo Logic CSE query detecting UAC bypass behaviors across three detection vectors: (1) auto-elevating Windows binaries spawning unexpected child processes, (2) HKCU registry modifications at UAC bypass paths such as ms-settings, mscfile, and exefile runas keys, and (3) CMSTPLUA COM elevation via cmstp.exe or dllhost.exe with CMSTPLUA CLSID. Targets Sysmon Event IDs 1 (process create), 12, and 13 (registry events).
Data Sources
Required Tables
False Positives & Tuning
- Windows built-in reset and troubleshooting tools (wsreset.exe for Windows Store cache, osk.exe for accessibility) legitimately launched by help desk staff or automated remediation scripts
- Penetration testing or red team exercises where UACME or similar tooling is used in authorized assessments — coordinate with security team to establish exclusions during test windows
- Third-party software that registers COM objects or modifies App Paths registry entries during installation using elevated MSI helper processes that appear as dllhost.exe children
Other platforms for T1548.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1UAC Bypass via eventvwr.exe (Registry Hijacking)
Expected signal: Sysmon EventCode 13: RegistryValueSet at HKCU\Software\Classes\mscfile\shell\open\command. Sysmon EventCode 1: eventvwr.exe process, followed by calc.exe (or cmd.exe) spawned with High integrity level. Security Event 4688 for calc.exe with high integrity.
- Test 2UAC Bypass via fodhelper.exe (ms-settings)
Expected signal: Sysmon EventCode 12/13: HKCU\Software\Classes\ms-settings\shell\open\command created with cmd.exe value. Sysmon EventCode 1: fodhelper.exe spawning cmd.exe with High integrity level.
- Test 3Check UAC Configuration and Current Integrity Level
Expected signal: Sysmon EventCode 1: reg.exe and whoami.exe process creation.
References (6)
- https://attack.mitre.org/techniques/T1548/002/
- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
- https://github.com/hfiref0x/UACME
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1548.002 including response playbook, investigation guide, and atomic red team tests.