An0nUD4Y-Offensive-COM/research/R4-uac-bypass.md

RESEARCH BRIEF — WINDOWS UAC BYPASS (MITRE ATT&CK T1548.002: Abuse Elevation Control Mechanism — Bypass User Account Control)

======================================================================
1. EXECUTIVE SUMMARY
======================================================================
User Account Control (UAC, introduced in Windows Vista) forces even administrator accounts to run with a "filtered" standard-user token until a process explicitly requests elevation. A "UAC bypass" is any technique that obtains a High-integrity / full-admin process WITHOUT the interactive consent or credential prompt. Key framing facts:

- Microsoft explicitly does NOT treat UAC as a hard security boundary, so most bypasses never receive CVEs or patches. MSRC reply quoted in public research: "we don't consider UAC a hard security boundary, but rather, a customizable enhancement..." (MSRC case 64957, per Stefan Kanthak; see Microsoft Security Servicing Criteria, aka.ms/windowscriteria).
- The reference implementation corpus is the open-source UACME project (hfiref0x), which documents 82 numbered methods; as of v3.7.x (2026), roughly 25+ remain "unfixed," working on Windows 10/11 including 24H2-era builds.
- At least 60 named threat groups/malware families use T1548.002 in the wild (MITRE): LockBit 2.0/3.0, BlackCat, Avaddon (CMSTPLUA), BADHATCH (CMSTPLUA + SilentCleanup), Raspberry Robin and Saint Bot (fodhelper), ZeroT/Pupy (eventvwr), WarzoneRAT (sdclt + IFileOperation), KONNI (token impersonation/SSPI — bypasses even "Always Notify"), APT38 (ieinstal.exe), Downdelph (RedirectEXE shim), etc.
- One UAC-dialog UI flaw DID get a CVE: CVE-2019-1388 (Windows Certificate Dialog EoP), now in CISA's Known Exploited Vulnerabilities catalog.

======================================================================
2. UAC INTERNALS — WHAT IS BEING BYPASSED
======================================================================
2.1 Core components and elevation flow
- LSASS (lsass.exe): at interactive logon of a "protected administrator" (Admin Approval Mode), creates TWO linked tokens: the full-privilege token and a filtered (restricted) token with admin SIDs/privileges stripped. Explorer.exe and all default children run on the filtered token at Medium integrity.
- Application Information service (Appinfo; appinfo.dll inside svchost, historically `C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo`; per-service hosting on Win10 1703+). This is the elevation broker. When CreateProcess fails with ERROR_ELEVATION_REQUIRED (740) — e.g., a manifest with `requestedExecutionLevel level="requireAdministrator"` or `ShellExecuteEx` with `lpVerb="runas"` — the request is forwarded to AppInfo over a local RPC/ALPC interface. James Forshaw documented the AppInfo RPC interface UUID {201ef99a-7fa0-444c-9399-19ba84f12a1a} and the RAiLaunchAdminProcess call (Google Project Zero blog, "Calling Local Windows RPC Servers", Dec 2019).
- consent.exe: the Consent UI, launched by AppInfo as NT AUTHORITY\SYSTEM at System integrity, displayed on the Secure Desktop (a separate Winlogon desktop where only SYSTEM-trusted processes can render/receive input, defeating UI spoofing — unless disabled via PromptOnSecureDesktop=0).
- On approval, AppInfo creates the elevated process (High integrity, full token). On denial, nothing runs.

2.2 Token model / integrity levels (Mandatory Integrity Control)
Integrity level SIDs (S-1-16-x): Untrusted=0, Low=4096 (0x1000), Medium=8192 (0x2000), Medium Plus=8448 (0x2100), High=12288 (0x3000), System=16384 (0x4000), Protected=20480 (0x5000).
Relevant token APIs/enums: TOKEN_ELEVATION_TYPE { TokenElevationTypeDefault=1, TokenElevationTypeFull=2, TokenElevationTypeLimited=3 }; TokenLinkedToken, TokenIntegrityLevel, TokenElevation via GetTokenInformation/NtQueryInformationToken; NtFilterToken (used to build the filtered token); UIPI (User Interface Privilege Isolation) blocks lower-IL processes from sending window messages to higher-IL windows unless the sender's manifest sets `uiAccess="true"` and it is signed + in a secure location.

2.3 Policy registry (all under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System)
- EnableLUA (1 default; 0 = UAC off entirely, breaks Store apps)
- ConsentPromptBehaviorAdmin: 0=Elevate without prompting, 1=Prompt for credentials on secure desktop, 2=Prompt for consent on secure desktop ("Always notify" slider), 3=Prompt for credentials, 4=Prompt for consent, 5=Prompt for consent for non-Windows binaries (DEFAULT)
- ConsentPromptBehaviorUser: 0=Auto-deny, 1=Prompt for credentials on secure desktop, 3=Prompt for credentials (default)
- PromptOnSecureDesktop (1 default), EnableInstallerDetection, ValidateAdminCodeSignatures (0 default), EnableSecureUIAPaths (1 default), EnableVirtualization (1 default), FilterAdministratorToken (0 default — built-in Administrator has NO split token and auto-elevates everything; UAC bypass is moot there), EnableUIADesktopToggle
- LocalAccountTokenFilterPolicy (0 default) — "Remote UAC" token filtering for local accounts over the network (relevant to lateral movement; Shamoon modified registry to weaken this)
- Slider mapping: Always notify = CPBA 2/POSD 1; Default = CPBA 5/POSD 1; No-dim = CPBA 5/POSD 0; Never notify = CPBA 0/POSD 0. (Microsoft Learn "User Account Control settings and configuration"; classic TechNet dd835564.)
- COMAutoApprovalList: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList — CLSIDs approved for silent COM elevation (see §4.2). Consent.exe consults this list.

2.4 Auto-elevation (the "backdoor" everyone abuses)
Since Windows 7, to reduce prompt fatigue, a process auto-elevates with NO prompt when ALL hold: (a) its manifest has `autoElevate="true"` (or it is on AppInfo's internal auto-approve EXE list, e.g., mmc.exe), (b) it resides in a trusted secure directory (%SystemRoot%\System32 and similar), (c) it is signed by Microsoft/Windows publisher, and (d) policy is at default (CPBA=5). Additional surfaces: approved COM classes (COMAutoApprovalList) and certain scheduled tasks running "with highest privileges." EVERY bypass family below poisons one of these trust inputs: what the binary resolves (registry associations), what it loads (DLLs), where it "lives" (mock dirs), or what environment it inherits.

2.5 The COM Elevation Moniker (documented Microsoft feature)
`CoGetObject(L"Elevation:Administrator!new:{CLSID}", &bind_opts, riid, &ppv)` with BIND_OPTS3.dwClassContext = CLSCTX_LOCAL_SERVER requests an out-of-process, elevated COM server. For classes on the COMAutoApprovalList, activation from a Medium-IL caller on default UAC is silent. (Microsoft Learn: "The COM Elevation Moniker".)

======================================================================
3. TECHNIQUE CATALOG — STEP-BY-STEP ATTACK CHAINS
(UACME method numbers referenced as [UACME #n]; "fixed in" data from the UACME v3.7.x README)
======================================================================

3.1 REGISTRY SHELL-ASSOCIATION HIJACKS (fileless; the most popular family)
Generic principle: an auto-elevating EXE internally ShellExecutes a protocol/file association. The per-user hive HKCU\Software\Classes overrides HKLM\Software\Classes, is writable at Medium IL, and the elevated process reads the attacker's verb command, executing it with the inherited HIGH-integrity token. No prompt, no file copy into protected paths.

A) fodhelper.exe → ms-settings (Windows 10 10240 → Windows 11, STILL UNFIXED per UACME #33/#67/#70; discovered by winscripting.blog, May 12 2017)
Steps:
 1. `reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "C:\path\payload.exe" /f`
 2. `reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /d "" /f` (emptying DelegateExecute is critical — otherwise the verb is routed to the registered COM handler and your (Default) command is ignored)
 3. Launch `C:\Windows\System32\fodhelper.exe` (Manage Optional Features; manifest autoElevate=true, MS-signed, System32) → it queries the ms-settings: protocol verb → executes payload at High IL.
 4. Cleanup: `reg delete "HKCU\Software\Classes\ms-settings" /f`.
 Variants: pure shell-protocol hijack [UACME #67, Arush Agarampur]; ProgID-based [UACME #70, V3ded]. Field status: functional on Win10/11 in 2024–2026 reporting (reliability varies by build/AV; ExploitWorldDev marks "partial" on some 22H2 builds). Used by Earth Lusca, Raspberry Robin, Saint Bot, KOCTOPUS.

B) computerdefaults.exe → ms-settings (same key as above) [UACME #62, winscripting.blog; works from Win10 RS4 17134, UNFIXED]

C) eventvwr.exe → mscfile (Windows 7–10; FIXED in Win10 RS2/1703 build 15031+ when Event Viewer was redesigned; Matt Nelson/enigma0x3 + Matt Graeber, Aug 15 2016)
Steps: set `HKCU\Software\Classes\mscfile\shell\open\command` (Default) = payload → run `%WINDIR%\System32\eventvwr.exe` → eventvwr launches mmc.exe eventvwr.msc, shell resolves mscfile verb from HKCU → payload High IL. Clean up key. Metasploit: exploit/windows/local/bypassuac_eventvwr (authors M. Nelson, M. Graeber, OJ Reeves). Used by ZeroT, Pupy, Koadic, BitPaymer (which also set HKCU\Software\Classes\ms-settings on Win10), Grandoreiro (registered as default .MSC handler).

D) sdclt.exe — three waves:
 1. App Paths (Win10 10240–16215; FIXED RS3): `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe` (Default)=payload; sdclt (Backup & Restore control panel launcher, auto-elevate) ShellExecutes "control.exe", which the shell resolves via the user-writable App Paths key. (enigma0x3, "Bypassing UAC using App Paths", Mar 14 2017) [UACME #29]
 2. Folder/isolated-command (10240–17025; FIXED RS4): hijack `HKCU\Software\Classes\Folder\shell\open\command`; sdclt's elevated folder launch resolves the Folder association from HKCU. (enigma0x3, "'Fileless' UAC Bypass using sdclt.exe", Mar 17 2017) [UACME #31]
 3. ShellRegMod variant (Win10 14393+, listed UNFIXED in UACME #53; Emeric Nasi/sevagas, "Yet another sdclt UAC bypass").

E) WSReset.exe → ms-windows-store AppID (Win10 17134/1803–1809; FIXED Win11 22000 for #56; protocol variant #68 by Arush Agarampur UNFIXED from 17763)
Steps: `HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\Open\command` (Default)=payload + `DelegateExecute`="" → run `C:\Windows\System32\WSReset.exe` (auto-elevate) → payload High IL. (Hashim Jawad, "Fileless UAC Bypass in Windows Store Binary", activecyber.us, Mar 2019; Atomic Red Team T1548.002 test #23; Splunk "WSReset UAC Bypass" analytic.)

F) Related registry surfaces: slui.exe/changepk.exe [UACME #45 fixed 19041; #61 UNFIXED from 14393]; COM handler hijack under HKCU\Software\Classes\CLSID\{...} against mmc.exe/recdisc.exe [#40/#47, fixed 19H1 18362]; BitlockerWizardElev race [#46, fixed RS4].

3.2 ELEVATED COM INTERFACE ABUSE
Mechanics: CoInitializeEx → build moniker `Elevation:Administrator!new:{CLSID}` → CoGetObject with BIND_OPTS3 (CLSCTX_LOCAL_SERVER) → call a method on the returned high-IL interface.

A) CMSTPLUA / ICMLuaUtil — the workhorse [UACME #41, Oddvar Moe; works Win7 7600 → present, UNFIXED]
- CLSID_CMSTPLUA = {3E5FC7F9-9A51-4367-9063-A120244FBEC7} (COM class implemented by cmluautil.dll/CMSTPLUA)
- IID_ICMLuaUtil = {6EDD6D74-C007-4E75-B76A-E5740995E24C}
- Method signature (undocumented; vtable slot after 6 placeholder methods):
  `HRESULT ShellExec(LPCWSTR lpFile, LPCWSTR lpParameters, LPCWSTR lpDirectory, ULONG fMask, ULONG nShow)`
- Chain: CoGetObject("Elevation:Administrator!new:{3E5FC7F9-...}") → ICMLuaUtil::ShellExec(L"C:\\Windows\\System32\\cmd.exe", NULL, NULL, SEE_MASK_DEFAULT, SW_SHOW) → elevated process, no prompt on default UAC.
- Modern wrinkle (2024–2026 research, codedintrusion/g3tsyst3m): on current Win10/11 builds, real-world loaders add PEB masquerading (overwrite PEB ImagePathName/FullPath to pose as a trusted binary such as explorer.exe/conhost.exe) before CoGetObject, because AppInfo scrutinizes the caller; also documented: ICMLuaUtil::CallCustomActionDll for running arbitrary DLL exports elevated. Observed in the JDownloader supply-chain malware (2026), FudCrypt, Avaddon, BADHATCH, LockBit 3.0.

B) IFileOperation — privileged file copy primitive [underpins UACME #1–#3, #8, #10, #12–#23, #57, #77; Leo Davidson lineage; UNFIXED]
- CLSID_FileOperation = {3AD05575-8857-4850-9277-11B85BDB8E09} (documented SDK constant), interface IFileOperation (shobjidl_core.h).
- Elevated via the moniker; SetOperationFlags(FOFX_SILENT | FOF_NOCONFIRMATION | FOFX_NOCONFIRMMKDIR | FOF_NOERRORUI), CopyItem(src, destFolder, NULL, NULL), PerformOperations() → copies attacker DLL INTO %SystemRoot%\System32 (or sysprep dir) from a Medium-IL process. This is the classic "privileged copy" that arms the DLL-hijack family (§3.3). WarzoneRAT uses IFileOperation on older OSes.

C) ElevatedFactoryServer → Task Scheduler (fileless, can yield SYSTEM directly) [UACME #74, zcgonvh; works Win8.1 9600+, UNFIXED]
- CoGetObject("Elevation:Administrator!new:{A6BFEA43-501F-456F-A845-983D3AD7B8F0}") → IElevatedFactoryServer (IID {804bd226-af47-4d71-b492-443a57610b08}; InProcServer32 class → surrogate/dllhost activation governed by HKLM\SOFTWARE\Classes\AppID\{A6BFEA43-...} LaunchPermission/AccessPermission SDs)
- `ServerCreateInstance({0f87369f-a4e5-4cfc-bd3e-73e6154572dd} /* CLSID TaskScheduler */, IID_IUnknown)` → elevated ITaskService → register a task whose XML `<Principal><UserId>SYSTEM</UserId><RunLevel>HighestAvailable</RunLevel>` → command runs as SYSTEM. Entirely in-memory/fileless.

D) Other auto-approved elevated COM interfaces (from UACME): ISecurityEditor (Simda #5 — turn off UAC via HKLM writes; also Native Image Cache poison #63/#71, UNFIXED), IFwCplLua (#42 fixed RS4; #66 fixed 24H2), IColorDataProxy + dccw.exe (#43, UNFIXED), ISPPLUAObject (#48, fixed RS5), IEditionUpgradeManager via clipup.exe + %windir% hijack (#58, Win10 14393 → fixed 24H2), IARPUninstallStringLauncher (#27, fixed RS3 16199), IIEAxiAdminInstaller/IIEAxiInstaller2 (IE add-on cache, #64, UNFIXED), IDiagnosticProfile (#75, UNFIXED), IWscAdmin shell-protocol (#65, fixed 24H2), ICreateNewLink/TpmInit (#49, fixed RS1 — note: "consent.exe COMAutoApprovalList introduction" killed it), UICleanmgrAdminHelper/UICleanmgrHelper via SystemSettingsAdminFlows.exe (#82, Win10 19041+, UNFIXED — newest method, v3.7.0).

3.3 DLL HIJACK / SIDE-LOAD INTO AUTO-ELEVATED BINARIES (usually armed via IFileOperation or mock dirs)
Pattern: find MS-signed auto-elevate EXE that imports a DLL NOT in KnownDlls by unqualified name → drop same-named DLL where the loader searches first (app dir / SxS DotLocal / WOW64 logger path) → elevated EXE loads attacker DLL. Historical/target list (component hijacked): sysprep.exe: cryptbase.dll (Win7–8.1, #1), dbgcore.dll (#12), unbcl.dll import-forwarding (#17), Actionqueue.dll (#8), unattend.dll (#57), ShCore.dll (#2), comctl32.dll via SxS .local (#21) — all fixed variously 9600–16232; cliconfg.exe: ntwdblib.dll (#7/#15, fixed RS1 — used by Operation Honeybee); migwiz.exe/mcx2prov.exe via wusa.exe /extract: cryptbase/cryptsp/wdscore (#6, fixed TH1 when WUSA /extract was removed; ShimRat hijacked cryptbase.dll in migwiz); winsat.exe: powprof.dll/devobj.dll (#10); consent.exe itself: comctl32.dll DotLocal (#22 — fixed only in Win11 24H2/25H2!); dccw.exe: GdiPlus.dll via SxS+NTFS junction (#36/#37, SandboxEscaper race, fixed 24H2); mmc.exe EventVwr.msc: elsext.dll (#13); mmc.exe Rsop.msc: WbemComn.dll (#20); mmc.exe: atl.dll (#77, UNFIXED); inetmgr.exe: MsCoree.dll (#19) / SLC.dll (#16); credwiz.exe/oobe.exe: netutils.dll (#14); GWXUXWorker.exe: SLC.dll (#16); pkgmgr.exe: DismCore.dll (#23, UNFIXED since Win7!); msdt.exe (SysWOW64)/sdiagnhost.exe: BluetoothDiagnosticUtil.dll (#72, Emeric Nasi, UNFIXED); iscsicpl.exe (SysWOW64): iscsiexe.dll (#76, UNFIXED); SystemPropertiesAdvanced.exe: srrstr.dll via %LocalAppData%\Microsoft\WindowsApps (#54, egre55, fixed 19H1); taskhostw.exe: pcadm.dll (#69, fixed 24H2) / PerformanceTraceHandler.dll (#80, Win11 26100→fixed 25H2); WOW64 logger wow64log.dll into any elevated 32-bit EXE (#30, fixed 24H2/25H2).
.NET profiler variant [UACME #39, Stefan Kanthak, UNFIXED]: set per-user env `COR_ENABLE_PROFILING=1`, `COR_PROFILER={GUID}`, `COR_PROFILER_PATH=C:\...\evil.dll` under HKCU\Environment → launch auto-elevated .NET process (mmc.exe) → CLR loads the "profiler" DLL elevated. (Splunk ".NET Profiler UAC bypass" analytic watches HKCU\Environment\COR_PROFILER_PATH.)
AppVerifier/IFEO variant [#9]: IFEO "VerifierDlls" value → attacker DLL loaded by elevated processes.

3.4 MOCK TRUSTED DIRECTORIES (path-normalization desync) [UACME #52, David Wells/Tenable 2020; worked Win7 7600 → FIXED Win11 24H2/25H2 via appinfo changes]
Root cause: AppInfo validates the trusted-directory requirement with `GetLongPathNameW`-normalized path + `RtlPrefixUnicodeString`, but creates the process with the ORIGINAL path. Create `C:\Windows \System32` (trailing space) — impossible in Explorer; use `md "\\?\C:\Windows \System32"` — then copy an auto-elevate EXE (e.g., easinvoker.exe — Exchange ActiveSync Invoker) plus its hijackable DLL (netutils.dll) inside. The trust check sees "C:\Windows\System32\..." (space stripped) → auto-elevates → loads attacker DLL at High IL. In-the-wild: DBatLoader/ModiLoader dropping Remcos RAT/Formbook (SentinelOne/Zscaler 2023, adding C:\Users to Defender exclusions), Fickle Stealer (fake WmiMgmt.msc + MMC en-US localization lookup). Detection note from SentinelOne: alert on any execution path containing trailing spaces, especially `\Windows \`.

3.5 ENVIRONMENT VARIABLE / SCHEDULED TASK ABUSE
A) SilentCleanup + %windir% hijack (enigma0x3, "Bypassing UAC on Windows 10 using Disk Cleanup", Jul 22 2016; generalized by James Forshaw, "Exploiting Environment Variables in Scheduled Tasks for UAC Bypass", May 2017) [UACME #34 — listed UNFIXED and AlwaysNotify-compatible, though field reports show the SilentCleanup-specific vector mitigated on later Win10 builds; version-dependent]
Steps: `reg add hkcu\Environment /v windir /d "cmd.exe /c <payload> & rem "` → `schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I` → the task's action `%windir%\system32\cleanmgr.exe ...` is expanded in the USER context at High IL → payload runs elevated. Works because the per-user environment overrides the machine variable during task action expansion.
B) DiskCleanup dismhost race (#26, Win10 10240→fixed RS2 15031): cleanmgr copies dismhost.exe+DLLs to %TEMP%\{GUID}; win the race to overwrite LogProvider.dll in a user-writable temp dir before the High-IL dismhost loads it.
C) Volatile env per-user SystemDirectory overrides (#44, bytecode77, fixed RS3 16299); clipup.exe+IEditionUpgradeManager %windir% (#58, fixed 24H2); RequestTrace scheduled task (#80); QuickAssist.exe EmbeddedBrowserWebView.dll + env/UIPI combo (#81, Win10 19041+, AlwaysNotify-compatible, UNFIXED).

3.6 TOKEN MANIPULATION / IMPERSONATION / APPINFO PROTOCOL ABUSE
- Token modification [UACME #35, "CIA & James Forshaw"; Win7→FIXED RS5 17686 by an added SeTokenCanImpersonate check in ntoskrnl]: duplicate the filtered token, flip it back to full via NtSetInformationToken-style manipulation, spawn elevated process. AlwaysNotify-compatible.
- SSPI datagram contexts (#78, antonioCoco/splintercod3, "Bypassing UAC with SSPI Datagram Contexts"; requires non-blank password; partially patched ~Win10 19041/2024): coerce a local elevated context via SSPI datagram RPC — the technique class KONNI used to bypass UAC even at "Always Notify."
- RAiLaunchAdminProcess + DebugObject [UACME #59, James Forshaw; Win7 7600+, UNFIXED]: abuse AppInfo's ALPC launch path with a debug object to inherit an elevated process.
- APPINFO command-line spoofing [UACME #38, Clement Rouault "hakril"; Win7+, UNFIXED]: craft a process whose path spoof satisfies AppInfo's whitelist parsing (mmc.exe + trailing arguments), so AppInfo itself launches attacker content elevated ("UAC Bypass or story about three escalations", habrahabr).

3.7 UIPI / uiAccess GUI HACKS
- #32 (xi-tauw; UNFIXED): hijack duser.dll/osksupport.dll into osk.exe / then leverage uiAccess to drive an elevated window.
- #55/#79 (Forshaw/Kanthak; fixed RS5 17763 + 2024 hardening): duplicate/modify a UIAccess token, lower IL, keep uiAccess → send synthetic input across IL boundary (fixed by stripping UIAccess when IL is lowered). Targets osk.exe, msconfig.exe, mmc.exe.

3.8 DIALOG/UI FLAW — CVE-2019-1388 (the exception that got a CVE)
"Windows Certificate Dialog Elevation of Privilege Vulnerability" (patched Nov 12, 2019; CISA KEV since Apr 2023; CWE-269). Root cause: consent.exe runs as SYSTEM, and its "Show information about the publisher's certificate" dialog rendered a live "Issued by" hyperlink. Chain: launch any unsigned app with runas → Show more details → publisher certificate → click issuer URL → a browser opens in the ELEVATED (SYSTEM) context → File→Save As → in the dialog address bar type `C:\Windows\System32\cmd.exe` → SYSTEM shell. Affects Win7 SP1→Win10 1709 and Server 2008R2→2019 (unpatched). PoC: github.com/nobodyatall648/CVE-2019-1388.

3.9 APPCOMPAT / MISC
RedirectEXE shim (#4; Downdelph built custom SDBs; fixed via KB3045645/KB3048097 + sdbinst auto-elevation removal), shim memory patch (#11), InfDefaultInstall whitelist (#28 — MS14-060/Sandworm; removed from g_lpAutoApproveEXEList), auto-elevate manifest trick on manifest-less MS EXEs (taskhost/tzsync, #18, fixed RS1 14371), .NET deserialization in Event Viewer (#73, orange_8361+antonioCoco, fixed 24H2 by EventViewer redesign).

======================================================================
4. CONSOLIDATED IOC / ARTIFACT TABLES
======================================================================
Registry keys (writes = high-fidelity signal):
- HKCU\Software\Classes\ms-settings\Shell\Open\command [(Default), DelegateExecute] — fodhelper/computerdefaults/slui-family
- HKCU\Software\Classes\mscfile\shell\open\command — eventvwr
- HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe — sdclt (legacy)
- HKCU\Software\Classes\Folder\shell\open\command — sdclt v2/v3
- HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\Open\command — WSReset
- HKCU\Software\Classes\CLSID\{...} (InprocServer32/handler redirects) — COM handler hijack
- HKCU\Environment [windir, COR_ENABLE_PROFILING, COR_PROFILER, COR_PROFILER_PATH] — SilentCleanup/.NET profiler
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System [EnableLUA, ConsentPromptBehaviorAdmin→0, PromptOnSecureDesktop→0] — UAC weakening (needs existing admin)
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<exe> [VerifierDlls]
- (reference/defense) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList
CLSID/IID watchlist: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} CMSTPLUA; IID {6EDD6D74-C007-4E75-B76A-E5740995E24C} ICMLuaUtil; {3AD05575-8857-4850-9277-11B85BDB8E09} FileOperation; {A6BFEA43-501F-456F-A845-983D3AD7B8F0} ElevatedFactoryServer; IID {804bd226-af47-4d71-b492-443a57610b08} IElevatedFactoryServer; {0f87369f-a4e5-4cfc-bd3e-73e6154572dd} TaskScheduler; string "Elevation:Administrator!new:".
Auto-elevate binaries commonly abused: fodhelper, computerdefaults, eventvwr, sdclt, wsreset, slui, changepk, mmc, osk, msconfig, colorcpl/dccw, sysprep, cliconfg, migwiz, mcx2prov, winsat, pkgmgr, msdt, sdiagnhost, iscsicpl, easinvoker, credwiz, inetmgr, BitlockerWizardElev, TpmInit, clipup, taskhostw, QuickAssist, SystemSettingsAdminFlows, CompMgmtLauncher (legacy), wusa, consent, rstrui, recdisc, ieinstal.
DLL names to watch outside System32/KnownDlls: cryptbase, cryptsp, wdscore, ntwdblib, dbgcore, unbcl, actionqueue, unattend, shcore, comctl32 (DotLocal), elsext, wbemcomn, atl, mscoree, slc, netutils, dismcore, gdiplus, powprof, devobj, wow64log, duser, osksupport, pcadm, PerformanceTraceHandler, EmbeddedBrowserWebView, BluetoothDiagnosticUtil, iscsiexe, srrstr, LogProvider.dll (in %TEMP%\{guid}).

======================================================================
5. DETECTION & HUNTING
======================================================================
Telemetry: Sysmon EID 1 (process create, with IntegrityLevel + ParentImage), EID 7 (image load), EID 10 (process access — handle/token duplication into fodhelper/eventvwr/computerdefaults/sdclt/slui/mmc/wsreset/pkgmgr per Splunk "Windows Handle Duplication in Known UAC-Bypass Binaries"), EID 11 (file create — mock dirs with trailing spaces; %TEMP%\{GUID}\dismhost staging), EID 12/13 (registry key/value set on all §4 paths); Security 4688 (+command line), 4657/4663 registry auditing; ETW Microsoft-Windows-Kernel-Process.
High-fidelity behavioral patterns:
1. High-integrity child process (cmd/powershell/payload in user paths) whose parent is a known auto-elevate binary (fodhelper, computerdefaults, eventvwr→mmc, sdclt, wsreset...) — near-zero FP (Splunk "FodHelper UAC Bypass", "Windows UAC Bypass Suspicious Child Process").
2. Registry write to HKCU\Software\Classes\{ms-settings|mscfile|Folder|AppX82a6...}\...\command or DelegateExecute emptied, followed within seconds by the matching System32 binary — classic automated chain (Splunk "WSReset UAC Bypass"; SigmaHQ has per-technique registry_set rules).
3. HKCU\Environment writes of windir / COR_PROFILER_PATH (Splunk ".NET Profiler UAC bypass") + schtasks /Run /TN ...SilentCleanup.
4. Process execution whose path contains trailing spaces (`C:\Windows \System32\...`) — mock trusted directory (SentinelOne recommendation; Sigma "TrustedPath UAC Bypass Pattern").
5. Image loads of the §4 DLL names from non-System32 locations by elevated Microsoft-signed processes.
6. Elevation events with NO consent.exe on the wire (silent elevation), plus command lines/strings containing "Elevation:Administrator!new:" (often stored reversed/XORed in malware).
Validation tooling: Atomic Red Team T1548.002 (tests for fodhelper, eventvwr, sdclt, WSReset #23, SilentCleanup, CMSTPLUA, .NET profiler, etc.); UACME Akagi for red-team ranges.
MITRE data sources: Process Creation, Windows Registry Key Creation/Modification, Module Load, Process Metadata (integrity level), OS API Execution (CoGetObject, NtSetInformationToken).

======================================================================
6. MITIGATION / HARDENING
======================================================================
- #1 control (per UACME itself): standard-user accounts — no admin token, no bypass possible. Privileged Account Management (M1026).
- UAC slider "Always notify" (ConsentPromptBehaviorAdmin=2, PromptOnSecureDesktop=1) kills most auto-elevate bypasses — but NOT all: SilentCleanup env (#34), token mod (#35), DiskCleanup race (#26), SSPI (#78), PCA (#69), RequestTrace (#80), QuickAssist (#81) are AlwaysNotify-compatible per UACME. Defense-in-depth still required.
- ConsentPromptBehaviorUser=0 (auto-deny for standard users); keep EnableLUA=1; FilterAdministratorToken=1 for built-in Administrator; keep PromptOnSecureDesktop=1.
- WDAC/AppLocker to block child processes of auto-elevate binaries and user-writable-path DLL loads; PreferSystem32Images mitigation; attack-surface monitoring of §4 keys.
- Patch currency: many methods died via OS hardening (RS1–RS5 shell updates, 19H1 COM handler fix, Win11 24H2/25H2 killed mock dirs, consent DotLocal, wow64log, dccw, .NET deserialization, wsreset, EditionUpgradeManager, taskhostw PCA) — current builds materially shrink the surface.
- Assume breach: detect (§5) rather than prevent; monitor LocalAccountTokenFilterPolicy/EnableLUA tampering (needs prior admin — signals post-exploitation).

======================================================================
7. MITRE ATT&CK MAPPING
======================================================================
- T1548.002 Bypass User Account Control (primary; Privilege Escalation + Defense Evasion)
- T1574.001/.002 Hijack Execution Flow: DLL Search Order/Side-Loading (§3.3)
- T1112 Modify Registry (association/env/policy keys)
- T1546.015 Event Triggered Execution: Component Object Model Hijacking (COM handler hijack)
- T1053.005 Scheduled Task (SilentCleanup, ITaskService via ElevatedFactoryServer)
- T1134.001/.002 Access Token Manipulation (token mod, SSPI, handle duplication)
- T1055 Process Injection (reflective loaders delivering CMSTPLUA calls)
- T1036 Masquerading (mock directories, PEB masquerading)
- T1027 Obfuscation (moniker strings reversed/XORed)
- T1562.001 Impair Defenses (post-elevation Defender exclusion/GP tamper, EnableLUA=0)
- Software examples: S0116 UACMe; in-the-wild: LockBit 2.0/3.0, Avaddon, BADHATCH, BitPaymer, Grandoreiro, KONNI, Raspberry Robin, Saint Bot, ZeroT, Pupy, Koadic, WarzoneRAT, DBatLoader, Fickle Stealer, Shamoon, Downdelph, BlackEnergy, H1N1, ShimRat, InvisiMole, Qilin.

======================================================================
8. DIAGRAMS TO DRAW
======================================================================
1. "Logon token split": Protected-admin logon → LSASS → [Full token | Filtered token] linked pair → Explorer on filtered/Medium token; annotation: TokenElevationType Limited vs Full.
2. "Elevation request flow": App w/ requireAdministrator manifest → CreateProcess fails 740 → ShellExecute runas → AppInfo service (svchost, appinfo.dll; RPC IF {201ef99a-...}, RAiLaunchAdminProcess) → policy/manifest/signature checks → consent.exe (SYSTEM) on Secure Desktop → Yes → elevated High-IL process. Number each hop — bypasses short-circuit specific hops.
3. "Auto-elevation decision tree": manifest autoElevate? → trusted dir? → MS signature? → COMAutoApprovalList/EXE whitelist? → CPBA policy? → silent vs prompt. Mark each attack surface (registry, DLL, path, env, COM).
4. "Registry hijack sequence (fodhelper)": attacker(Medium) → write HKCU ms-settings verb + DelegateExecute="" → launch fodhelper.exe (auto-elevates High) → shell resolves ms-settings: from HKCU → payload.exe spawned High IL → key cleanup. Show the IL jump Medium→High with no consent.exe.
5. "COM elevation (CMSTPLUA)": CoGetObject("Elevation:Administrator!new:{3E5FC7F9-...}") → AppInfo silent approval (COMAutoApprovalList) → surrogate COM server at High IL → ICMLuaUtil::ShellExec("cmd.exe") → High-IL child.
6. "IFileOperation + DLL hijack (sysprep pattern)": Medium process → elevated IFileOperation copy evil-cryptbase.dll → C:\Windows\System32\sysprep\ → launch sysprep.exe (auto-elevate) → loader search order → attacker DLL in High-IL process.
7. "Mock trusted directory": two-string desync — GetLongPathNameW("C:\Windows \System32\easinvoker.exe") → "C:\Windows\System32\..." passes RtlPrefixUnicodeString trust check; original spaced path used for CreateProcess; netutils.dll loaded High.
8. "SilentCleanup windir chain": HKCU\Environment windir=cmd /c payload & rem → schtasks /Run SilentCleanup → Task Scheduler expands %windir%\system32\cleanmgr.exe in user context at High IL → payload runs elevated.
9. "Integrity level pyramid + MIC write rules": Untrusted/Low/Medium/Medium+/High/System/Protected with S-1-16 values; UIPI message-blocking arrow; where each bypass lands.
10. "Detection coverage map": rows = technique families (3.1–3.9); columns = telemetry (Sysmon 1/7/10/11/12/13, 4688, ETW) with named analytics (Splunk/Sigma/Atomic) per cell.

======================================================================
9. REFERENCES (title — URL)
======================================================================
Core corpora & frameworks:
1. UACME — Defeating Windows User Account Control (hfiref0x) — https://github.com/hfiref0x/UACME
2. MITRE ATT&CK T1548.002 — Bypass User Account Control — https://attack.mitre.org/techniques/T1548/002/
3. Atomic Red Team T1548.002 tests — https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
4. Atomic Red Team docs site T1548.002 — https://www.atomicredteam.io/atomic-red-team/atomics/T1548.002
Microsoft documentation:
5. How User Account Control works — Microsoft Learn — https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works
6. User Account Control settings and configuration — Microsoft Learn — https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration
7. The COM Elevation Moniker — Microsoft Learn — https://learn.microsoft.com/en-us/windows/win32/com/the-com-elevation-moniker
8. UAC Group Policy Settings and Registry Key Settings (archived TechNet dd835564) — http://crw-daq.su/download/admilink/uac/uac-doc/technet.microsoft.com-uac group policy settings and registry key settings.pdf
9. Microsoft Security Servicing Criteria for Windows (UAC-not-a-boundary policy) — https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria
Original technique research:
10. "Fileless" UAC Bypass Using eventvwr.exe and Registry Hijacking — enigma0x3 (Aug 15, 2016) — https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
11. Bypassing UAC on Windows 10 using Disk Cleanup — enigma0x3 (Jul 22, 2016) — https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/
12. Bypassing UAC using App Paths — enigma0x3 (Mar 14, 2017) — https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
13. "Fileless" UAC Bypass using sdclt.exe — enigma0x3 (Mar 17, 2017) — https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
14. First entry: Welcome and fileless UAC bypass (fodhelper) — winscripting.blog (May 12, 2017) — https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
15. Exploiting Environment Variables in Scheduled Tasks for UAC Bypass — James Forshaw (May 2017) — https://tyranidslair.blogspot.com/2017/05/exploiting-environment-variables-in.html
16. Reading Your Way Around UAC (Parts 1–3) — James Forshaw — https://tyranidslair.blogspot.com/2017/05/reading-your-way-around-uac-part-1.html
17. Calling Local Windows RPC Servers — James Forshaw, Google Project Zero (Dec 2019; AppInfo RPC {201ef99a-7fa0-444c-9399-19ba84f12a1a}) — https://googleprojectzero.blogspot.com/2019/12/calling-local-windows-rpc-servers-from.html
18. UAC Bypass by Mocking Trusted Directories — David Wells, Tenable TechBlog — https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
19. Accessing Access Tokens for UIAccess — James Forshaw (Feb 2019) — https://tyranidslair.blogspot.com/2019/02/accessing-access-tokens-for-uiaccess.html
20. Fileless UAC Bypass in Windows Store Binary (WSReset) — ActiveCyber (Mar 2019) — https://www.activecyber.us/1/post/2019/03/windows-uac-bypass.html
21. UAC Bypass via SystemPropertiesAdvanced.exe and DLL Hijacking — egre55 — https://egre55.github.io/system-properties-uac-bypass/
22. Utilizing Programmatic Identifiers (ProgIDs) for UAC Bypasses — V3ded — https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses
23. UAC bypasses from COMAutoApprovalList — swapcontext (Nov 2020) — https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html
24. Yet another sdclt UAC bypass — Emeric Nasi, sevagas — http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass
25. MSDT DLL Hijack UAC bypass — sevagas — https://blog.sevagas.com/?MSDT-DLL-Hijack-UAC-bypass
26. UAC bypass via elevated .NET applications — offsec.provadys — https://offsec.provadys.com/UAC-bypass-dotnet.html
27. Advanced Windows Task Scheduler Playbook Part 2 (IElevatedFactoryServer) — zcgonvh — http://www.zcgonvh.com/post/Advanced_Windows_Task_Scheduler_Playbook-Part.2_from_COM_to_UAC_bypass_and_get_SYSTEM_dirtectly.html
28. Bypassing UAC with SSPI Datagram Contexts — antonioCoco, splintercod3 — https://splintercod3.blogspot.com/p/bypassing-uac-with-sspi-datagram.html
29. Mitigate some Exploits for Windows UAC (incl. MSRC case 64957 quote) — Stefan Kanthak — https://skanthak.hier-im-netz.de/uacamole.html
30. Reversing ICMLuaUtil: ShellExec and CallCustomActionDll — codedintrusion — https://codedintrusion.com/posts/reversing-icmluautil/
31. Creative UAC Bypass Methods for the Modern Era — g3tsyst3m — https://g3tsyst3m.github.io/privilege%20escalation/Creative-UAC-Bypass-Methods-for-the-Modern-Era/
32. UAC Bypass or story about three escalations (hakril APPINFO spoof) — Positive Research, Habr — https://habrahabr.ru/company/pm/blog/328008/
CVE-2019-1388:
33. NVD — CVE-2019-1388 Detail — https://nvd.nist.gov/vuln/detail/CVE-2019-1388
34. CVE-2019-1388 — Abuse UAC Windows Certificate Dialog (PoC) — https://github.com/nobodyatall648/CVE-2019-1388
35. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
In-the-wild use:
36. Old Windows 'Mock Folders' UAC bypass used to drop malware — BleepingComputer (Mar 2023) — https://www.bleepingcomputer.com/news/security/old-windows-mock-folders-uac-bypass-used-to-drop-malware/
37. DBatLoader and Remcos RAT Sweep Eastern Europe — SentinelOne — https://www.sentinelone.com/blog/dbatloader-and-remcos-rat-sweep-eastern-europe/
38. Fickle Stealer Distributed via Multiple Attack Chain — Fortinet FortiGuard Labs — https://www.fortinet.com/blog/threat-research/fickle-stealer-distributed-via-multiple-attack-chain
39. In-Memory Loader Drops ScreenConnect (elevated COM abuse) — Zscaler ThreatLabz — https://www.zscaler.com/blogs/security-research/memory-loader-drops-screenconnect
Detection engineering:
40. Detection: FodHelper UAC Bypass — Splunk Threat Research — https://research.splunk.com/endpoint/909f8fd8-7ac8-11eb-a1f3-acde48001122/
41. Detection: WSReset UAC Bypass — Splunk Threat Research — https://research.splunk.com/endpoint/8b5901bc-da63-11eb-be43-acde48001122/
42. Detection: .NET Profiler UAC bypass — Splunk Threat Research — https://research.splunk.com/endpoint/0252ca80-e30d-11eb-8aa3-acde48001122/
43. Windows Handle Duplication in Known UAC-Bypass Binaries — Splunk Threat Research — https://research.splunk.com/endpoint/d7369bf5-1315-4138-b927-2dd8bb8c1da7/
44. Windows UAC Bypass Suspicious Child Process — Splunk Threat Research — https://research.splunk.com/endpoint/453a6b0f-b0ea-48fa-9cf4-20537ffdd22c/
45. Sigma — Generic Signature Format for SIEM Systems (UAC bypass rule set) — https://github.com/SigmaHQ/sigma
46. UAC Bypass Detection: A Comprehensive Guide — Fibratus — https://fibratus.io/blog/uac-bypass-detection-comprehensive-guide
47. Metasploit module: bypassuac_eventvwr — Rapid7 — https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/bypassuac_eventvwr.rb
48. Hardening Microsoft Windows 10/11 Workstations (UAC policy recommendations) — Australian Cyber Security Centre — https://www.cyber.gov.au/sites/default/files/2025-09/hardening_microsoft_windows_10_workstations_september_2025.pdf
49. User Account Control/Uncontrol: Mastering the Art of Bypassing Windows UAC — hadess.io — https://hadess.io/user-account-control-uncontrol-mastering-the-art-of-bypassing-windows-uac/
50. Malicious Application Compatibility Shims — Black Hat EU 2015 (Pierce) — https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf

======================================================================
10. CONFIDENCE & CAVEATS
======================================================================
- HIGH confidence: all CLSIDs/IIDs quoted (CMSTPLUA, ICMLuaUtil, FileOperation, ElevatedFactoryServer, IElevatedFactoryServer, TaskScheduler, AppInfo RPC IF), all registry paths, policy values, method numbers/authors/fixed-in builds (verbatim from UACME v3.7.x README, retrieved this session), CVE-2019-1388 facts (NVD retrieved directly), and every reference URL (each appeared in this session's search results or fetched pages).
- MEDIUM confidence / version-dependent: current exploitability on the very latest builds. UACME marks items "unfixed" as of v3.7.x (2026), but independent testers report some (fodhelper, SilentCleanup, mock dirs pre-24H2) behaving inconsistently across 22H2–25H2 due to silent hardening and AV/EDR interference. Treat "unfixed" as "UACME-listed unfixed," not a guarantee on a specific patched build.
- IID for IColorDataProxy or CLSIDs for ISecurityEditor/IFwCplLua/ISPPLUAObject not independently verified — excluded from the CLSID watchlist; they are in UACME source (comsup.h).
- Cross-links: LocalAccountTokenFilterPolicy → lateral movement chapter; COMAutoApprovalList/elevation moniker → COM internals chapter.