T1548.002sub-technique of T1548 Abuse Elevation Control Mechanism
Bypass User Account Control
Windowsnothing on this site yetT1548.002 on attack.mitre.org
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection Strategy for T1548.002 – Bypass User Account Control (UAC)
- Detects a multi-event behavior chain involving UAC bypass attempts via known auto-elevated binaries (e.g., eventvwr.exe, sdclt.exe), unauthorized Registry changes to UAC-related keys, and anomalous process execution with elevated privileges but lacking standard parent-child lineage.
what reduces it
- M1052 User Account Control. Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
- M1026 Privileged Account Management. Remove users from the local administrator group on systems.
- M1047 Audit. Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.
- M1051 Update Software. Consider updating Windows to the latest version and patch level to utilize the latest protective measures against UAC bypass.