T1548.002 — Bypass User Account Control

Tactic: Privilege Escalation · Platforms: Windows

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the…

Sub-technique of Abuse Elevation Control Mechanism (T1548).

Sigma detection rules (1)

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control - Auto-Elevate Binary Executed

title: "T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control - Auto-Elevate Binary Executed"
id: 2f2c6cc3-42f5-4b84-a030-900d7cc7af5c
status: test
description: 'Detects execution of a Windows binary with the ''autoElevate'' manifest flag that is commonly abused for UAC bypass via registry hijacking (fodhelper, eventvwr, sdclt, computerdefaults, slui).'
references:
  - https://attack.mitre.org/techniques/T1548/002/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_fodhelper:
    ParentImage|endswith: '\fodhelper.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\mshta.exe'

  selection_eventvwr:
    ParentImage|endswith: '\eventvwr.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'

  condition: 1 of selection_*

falsepositives:
  - Essentially none for the fodhelper/eventvwr UAC-bypass patterns specifically — a child process spawned directly from fodhelper.exe or eventvwr.exe is not normal Windows behavior.

level: critical

Related sub-techniques

Explore