value:  Cobalt Group has bypassed UAC. ;; Cobalt Strike can use a number of known techniques to bypass Windows UAC. ;; CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges. ;; Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database. ;; Empire includes various modules to attempt to bypass UAC for escalation of privileges. ;; Evilnum has used PowerShell to bypass UAC. ;; FinFisher performs UAC bypass. ;; Grandoreiro can bypass UAC by registering as the default handler for .MSC files. ;; H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe). ;; Honeybee uses a combination of NTWDBLIB.dll and cliconfg.exe to bypass UAC protections using DLL hijacking. ;; InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges. ;; Koadic has 2 methods for elevating integrity. It can bypass UAC through eventvwr.exe and sdclt.exe. ;; KONNI bypassed UAC with the “AlwaysNotify” settings. ;; MuddyWater uses various techniques to bypass UAC. ;; Patchwork bypassed User Access Control (UAC). ;; PipeMon installer can use UAC bypass techniques to install the payload. ;; An older variant of PLAINTEE performs UAC bypass. ;; PoshC2 can utilize multiple methods to bypass UAC. ;; Pupy can bypass Windows UAC through either DLL hijacking eventvwr or appPaths. ;; Ramsay can use UACMe for privilege escalation. ;; Remcos has a command for UAC bypassing. ;; RTM can attempt to run the program as admin then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges. ;; Sakula contains UAC bypass code for both 32- and 64-bit systems. ;; Shamoon attempts to disable UAC remote restrictions by modifying the Registry. ;; ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing. ;; A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges. ;; UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. ;; Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.
name: Abuse Elevation Control Mechanism: Bypass User Account Control