UAC Bypass via Registry Handler
| Field |
Value |
| ATT&CK technique |
T1548.002 — Abuse Elevation Control Mechanism: Bypass User Account Control |
| Tactic |
Privilege Escalation, Defense Evasion |
| Log source |
Sysmon Operational (WS01) |
| Index |
lab_sysmon |
| Severity |
High |
| Status |
Validated — 2026-09-24 |
| Author |
Samuel Emerson |
| Created |
2026-09-24 |
| Validated |
2026-09-24 — evidence |
Hypothesis
Several auto-elevating Windows binaries launch a helper program by reading a path from a per-user
registry key, for example HKCU\Software\Classes\mscfile\shell\open\command. Because the key lives
in the user’s hive, a normal user can write to it, and the auto-elevating binary — Event Viewer
(eventvwr.exe) in this case — then runs the planted command at high integrity without a UAC
prompt. Writing to one of these handler keys is the signature of the technique.
Sysmon records registry value writes as event 13 (SetValue) and key/value deletes as event 12. The
detection watches for a write to a shell\open\command key under the handler names these bypasses
use.
Detection logic
index=lab_sysmon source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=12 OR EventCode=13) TargetObject="*\\shell\\open\\command*"
(TargetObject="*ms-settings*" OR TargetObject="*mscfile*" OR TargetObject="*exefile*" OR TargetObject="*\\Folder\\*")
| table _time host User Image EventType TargetObject Details
Details holds the value written — the command the auto-elevating binary would run. Image is the
process that wrote the key, which is the more suspicious indicator: a shell or script interpreter
writing a handler key is not normal.
Field reference
| Field |
Source |
Meaning |
EventCode=13 |
Sysmon |
Registry value set |
EventCode=12 |
Sysmon |
Registry key/value created or deleted |
TargetObject |
Sysmon |
Full registry path written |
Details |
Sysmon |
The value written (the planted command) |
Image |
Sysmon |
The process that made the change |
EventType |
Sysmon |
SetValue, CreateKey, DeleteValue |
Validation
| Item |
Detail |
| Atomics |
Atomic Red Team master, downloaded 2026-09-24 |
| Test |
#1 Bypass UAC using Event Viewer (cmd) · 5073adf8-9a50-4bd9-b298-a9bd2ead8af9 |
| Executed at |
2026-09-24 15:43:57 CDT (execution log) |
| Events produced |
Sysmon 13 (SetValue) at 15:43:58 — reg.exe wrote mscfile\shell\open\command\(Default) = C:\Windows\System32\cmd.exe |
| Detection fired |
Yes — scheduled run at 15:45:01, 1 result (alert log) |
| Time to detect |
1 min 04 s |
| Evidence |
Sysmon 12/13 events · screenshot · alert screenshot |
| Defender interaction |
15 seconds after the write, Microsoft Defender (MsMpEng.exe) removed the planted value — recorded as a Sysmon event 12 (DeleteValue) at 15:44:13. The endpoint control reverted the change on its own |
| Cleanup |
ART -Cleanup for the test; the key was already removed by Defender |
Note on elevation. This detection confirms the registry write, which is the technique’s
signature — not that a process ultimately ran elevated. Whether the bypass completed was not
measured: no integrity level was captured for any eventvwr.exe child, and no UAC prompt was
observed either way. Microsoft Defender removed the planted value 15 seconds after it was written,
which would break the chain before Event Viewer read the key. Detecting the write is the point: it
fires whether or not the elevation succeeds.
False positives
| Scenario |
Likelihood |
Tuning |
| A legitimate installer registering a file-type handler |
Low–medium |
Allowlist by Image (the installer) and by the specific handler |
Software writing HKCU class registrations |
Low |
Baseline which processes legitimately write these keys |
Response guidance
- Read
Details — the command that was planted.
- Identify
Image — which process wrote the key. A shell or script interpreter is a strong signal.
- Check for the auto-elevating binary (
eventvwr.exe, fodhelper.exe, computerdefaults.exe)
launching shortly after, and its child processes’ integrity level.
- If unexplained: capture the key contents, remove the planted value, and pivot to the writing
process.
Gaps
- Only the handler families in the search are covered (
ms-settings, mscfile, exefile,
Folder). Other UAC-bypass variants use different keys, different auto-elevating binaries, or no
registry write at all (for example directory-mocking or token-manipulation methods) and would not
match.
- The detection sees the write, not the outcome. Pair it with a rule for a high-integrity child of
an auto-elevating binary to catch a successful bypass.
NIST 800-53 mapping
| Control |
Relevance |
| AC-6 |
Least privilege — detecting attempts to circumvent elevation control |
| AU-2 / AU-12 |
Audit of registry modifications |
| SI-4 |
System monitoring for privilege-escalation indicators |
