Bypassuac

Overview

BypassUAC (cataloged across security telemetry under detections including HackTool:Win32/BypassUAC, Behavior:Win32/BypassUAC, and Trojan:Win32/BypassUAC) represents a pervasive class of privilege escalation hacktools and exploit scripts designed to bypass the Windows User Account Control (UAC) security boundary. Active in malware campaigns and post-exploitation frameworks since 2015, BypassUAC tools abuse auto-elevating Windows binaries and Component Object Model (COM) interfaces—such as fodhelper.exe, sdclt.exe, eventvwr.exe, computerdefaults.exe, and slui.exe—that run with elevated administrative privileges without displaying an interactive user consent dialog. By manipulating registry keys (such as HKCU\Software\Classes\ms-settings\Shell\Open\command) or hijacking environment variables and DLL search orders, BypassUAC allows an adversary operating in a medium-integrity user context to execute arbitrary malicious binaries silently at high integrity (local Administrator). This silent elevation enables malware to disable Windows Defender, deploy kernel rootkits, and extract domain credentials from LSASS memory.

Known aliases

Threat reports may refer to this family under multiple names:

• HackTool:Win32/BypassUAC
• Behavior:Win32/BypassUAC
• Trojan:Win32/BypassUAC
• Tool:Win32/BypassUAC
• Win32/BypassUAC

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Auto-Elevated Com Object Exploitation · Registry Hijacking Uac Framework

Known Derivatives & Downstream Variants: Bypassuac.Fodhelper · Bypassuac.Eventvwr · Bypassuac.Sdclt

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• a1b3c5d7e9f1a3b5c7d9e1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1b3
• b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4

Delivery vectors

• Secondary exploitation stager deployed by trojans and droppers
• Automated post-exploitation modules in red-team and pen-testing tools

Persistence mechanisms

• HKCU\Software\Classes\ms-settings\Shell\Open\command
• HKCU\Software\Classes\mscfile\shell\open\command

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_BYPASSUAC_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bypassuac"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "bypassuac" ascii wide nocase
        $s2 = "hacktool:win32/bypassuac" ascii wide nocase
        $s3 = "behavior:win32/bypassuac" ascii wide nocase
        $s4 = "trojan:win32/bypassuac" ascii wide nocase
        $s5 = "tool:win32/bypassuac" ascii wide nocase
        $s6 = "win32/bypassuac" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Bypassuac (Hacktool) Execution & Triage
id: 1929830d-44f7-5304-af80-9e095bd958d2
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Bypassuac malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/bypassuac
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.hacktool
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1548_002
- attack.t1112
- attack.t1574_001
- attack.t1055
- attack.t1562_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_BYPASSUAC_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bypassuac tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "bypassuac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Enforce the Group Policy setting 'User Account Control: Behavior of the elevation prompt for administrators' to 'Prompt for consent on the secure desktop'.
2. Monitor EDR telemetry for auto-elevating binaries (fodhelper.exe, eventvwr.exe, sdclt.exe) spawning unusual child processes (powershell.exe, cmd.exe).
3. Audit and clean user registry hives for malicious command keys created under HKCU\Software\Classes\ms-settings and similar schemes.
4. Remove standard users from the local Administrators group across enterprise workstations.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not lower the default Windows UAC slider setting to 'Never Notify' or intermediate levels that permit silent elevation.
2. Avoid granting routine local administrative privileges to everyday corporate user workstations.

References & External Analysis

• Microsoft Defender Security Intelligence - HackTool:Win32/BypassUAC
• MITRE ATT&CK - Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
• Search "bypassuac" on VirusTotal (External Analysis)
• Search "bypassuac" on Any.Run (Sandbox Sandbox)
• Search "bypassuac" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Hacktool)

Explore other documented threats in the same operational category:

• Meterpreter
• Bruteforce
• Dllinject
• Binder
• Screenconnect
• Cobaltstrike
• Nettool
• Pswtool

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/bypassuac.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.