Windows UAC Bypass Techniques and Defenses
Summary
A lab walkthrough demonstrates UAC bypasses on a default-configured Windows 10 host, elevating a medium-integrity administrator session. It also recommends least privilege, registry monitoring, PowerShell logging, application control and patching.
Key points
- The walkthrough starts with a local administrator account running at medium integrity on a default-configured Windows 10 host.
- It demonstrates bypasses using Metasploit modules and auto-elevating binaries including fodhelper.exe, ComputerDefaults.exe, sdclt.exe and SilentCleanup.
- The lab techniques produce high-integrity sessions without a UAC consent prompt.
- The article recommends removing standing local administrator rights and raising the UAC prompt level.
- It advises monitoring relevant registry paths and enabling PowerShell Script Block Logging and AMSI.
- AppLocker or WDAC enforcement and keeping Windows patched are presented as additional layers of defense.
Article Details
- Topic
- Windows 10 User Account Control bypass techniques and defenses
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]168[.]1[.]17 | Attacker-controlled lab host used to serve payloads and receive reverse-shell callbacks. |
| URL | hxxp[:]//192[.]168[.]1[.]17/bypass.ps1 | Attacker-hosted PowerShell wrapper downloaded to perform a registry-based UAC bypass. |
| URL | hxxp[:]//192[.]168[.]1[.]17/improved-fodhelper.ps1 | Attacker-hosted PowerShell script downloaded to perform the fodhelper UAC bypass. |
| URL | hxxp[:]//192[.]168[.]1[.]17/new.exe | Attacker-hosted executable payload downloaded for the ComputerDefaults UAC bypass. |
| URL | hxxp[:]//192[.]168[.]1[.]17/rev.ps1 | Attacker-hosted reverse-shell payload downloaded and executed during the UAC bypass. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe SilentCleanup scheduled task is triggered to execute a payload at high integrity.T1055 · Process InjectionThe bypassuac_injection_winsxs method performs in-memory DLL injection into a spawned process.T1059.001 · PowerShellPowerShell scripts and commands download and execute payloads and perform registry hijacks.T1105 · Ingress Tool TransferPayloads and helper scripts are transferred from the attacker host to the Windows victim.T1112 · Modify RegistryThe techniques modify per-user registry keys and values to hijack auto-elevating binaries.T1548.002 · Bypass User Account ControlThe demonstrated techniques bypass User Account Control to elevate from medium to high integrity.
Vendors
Products
AppLocker#UAC #fodhelper.exe #ComputerDefaults.exeMicrosoft Defender for EndpointThe same paths can be monitored through Microsoft Defender for Endpoint, Elastic Defend, or any modern EDR platform.PowerShellIt also maps each method to practical defenses such as Always Notify UAC, registry monitoring, PowerShell logging, and application whitelisting.WDAC#UAC #fodhelper.exe #ComputerDefaults.exeWindows 10This article demonstrates eight User Account Control bypass techniques on a default-configured Windows 10 host, including Metasploit modules and manual registry hijacks using fodhelper.exe and ComputerDefaults.exe.
Tools
Metasploit FrameworkThe attacker box is a current Kali Linux build with Metasploit Framework, msfvenom, netcat, rlwrap, and a Python HTTP server for payload delivery.msfvenomBuilding an msfvenom Payload and HandlernetcatThe attacker box is a current Kali Linux build with Metasploit Framework, msfvenom, netcat, rlwrap, and a Python HTTP server for payload delivery.RevShellsGenerating a PowerShell Reverse Shell with RevShellsrlwrapThe attacker box is a current Kali Linux build with Metasploit Framework, msfvenom, netcat, rlwrap, and a Python HTTP server for payload delivery.Sysmon#UAC #fodhelper.exe #ComputerDefaults.exe