title: Bypass UAC Using DelegateExecute
id: 46dd5308-4572-4d12-aa43-8938f0184d4f
description: Bypasses User Account Control using a fileless method
author: frack113
date: 2022/01/05
status: experimental
references:
    - https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
    - https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        EventType: SetValue
        TargetObject|endswith: \open\command\DelegateExecute
        Details: (Empty)
    condition: selection
falsepositives:
    - Unknown
level: high
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1548.002
