AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.^[9]

APT29 has bypassed UAC.^[10]

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.^[11]

AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.^[12]

Avaddon bypasses UAC using the CMSTPLUA COM interface.^[13]

Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.^[14]

BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.^[15]

BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.^[16]

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.^[17][18]

Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.^[19]

Clambling has the ability to bypass UAC using a passuac.dll file.^[20][21]

Cobalt Group has bypassed UAC.^[22]

Cobalt Strike can use a number of known techniques to bypass Windows UAC.^[23][24]

CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.^[25]

Downdelph bypasses UAC to escalate privileges by using a custom "RedirectEXE" shim database.^[26]

Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.^[27]

Empire includes various modules to attempt to bypass UAC for escalation of privileges.^[28]

Evilnum has used PowerShell to bypass UAC.^[29]

FinFisher performs UAC bypass.^[30][31]

Gelsemium can bypass UAC to elevate process privileges on a compromised host.^[32]

Grandoreiro can bypass UAC by registering as the default handler for .MSC files.^[33]

H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).^[34]

InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.^[35][36]

Koadic has 2 methods for elevating integrity. It can bypass UAC through eventvwr.exe and sdclt.exe.^[37]

KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.^[38]

KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to "AlwaysNotify".^[39][40]

Lokibot has utilized multiple techniques to bypass UAC.^[41]

MuddyWater uses various techniques to bypass UAC.^[42]

During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and cliconfig.exe to bypass UAC protections.^[43]

Patchwork bypassed User Access Control (UAC).^[44]

PipeMon installer can use UAC bypass techniques to install the payload.^[45]

An older variant of PLAINTEE performs UAC bypass.^[46]

PoshC2 can utilize multiple methods to bypass UAC.^[47]

Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.^[48]

QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.^[49]

Ramsay can use UACMe for privilege escalation.^[50][51]

RCSession can bypass UAC to escalate privileges.^[20]

Remcos has a command for UAC bypassing.^[52]

RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.^[53]

Saint Bot has attempted to bypass UAC using fodhelper.exe to escalate privileges.^[54]

Sakula contains UAC bypass code for both 32- and 64-bit systems.^[55]

Shamoon attempts to disable UAC remote restrictions by modifying the Registry.^[56]

ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.^[57]

SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the .msc file extension.^[58]

A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.^[59]

UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.^[5]

WarzoneRAT can use sdclt.exe to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.^[60][61]

WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.^[62]

Winnti for Windows can use a variant of the sysprep UAC bypass.^[63]

Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.^[64]

Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.^[5]

Remove users from the local administrator group on systems.

Consider updating Windows to the latest version and patch level to utilize the latest protective measures against UAC bypass.^[5]

Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking.