Loading story…
Security researchers published multiple technical demonstrations showing how Windows User Account Control (UAC) can still be bypassed through complex elevation paths, including a method described by James Forshaw and a later public proof of concept, SspiUacBypass, that uses SSPI Datagram Contexts to obtain elevated execution. The GitHub project exposes C++ research code for the technique and links it to broader work on abusing Windows elevation mechanisms, underscoring that UAC bypass tradecraft remains publicly documented and reproducible for attackers as well as defenders.
A separate review of Microsoft’s upcoming Windows 11 Administrator Protection feature says the redesign reduces exposure to common split-token and COM auto-elevation abuse by introducing per-user "Shadow Admin" accounts, but does not fully eliminate legacy elevation weaknesses. The analysis says some bypass avenues and risky behaviors still persist, including issues tied to LocalAccountTokenFilterPolicy, RunOnce auto-elevation behavior, and certain UIAccess interactions, leaving enterprises with a transitional model where newer protections coexist with older high-integrity token paths.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
An XPN InfoSec blog post reviewed Microsoft's Administrator Protection feature for Windows 11 and reported that, despite removing many classic UAC elevation paths, some legacy elevation behaviors and bypass opportunities still remained.
A public GitHub repository for "SspiUacBypass" was released, providing proof-of-concept C++ code for bypassing UAC using SSPI Datagram Contexts and linking to fuller technical details.
A March 2022 blog post by James Forshaw described a complex method for bypassing Windows User Account Control, documenting the technique publicly as security research.
A Tyranid's Lair blog post described techniques for accessing access tokens for UIAccess, documenting an earlier Windows privilege and elevation-related research finding relevant to later UAC bypass work.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
blog.xpnsec.com
Open sourcegithub.com
Open sourcesplintercod3.blogspot.com
Open sourcetiraniddo.dev
Open sourcetiraniddo.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public GitHub repository exposes a PowerShell proof-of-concept for bypassing Windows User Account Control (UAC) by abusing the Microsoft Connection Manager Profile Installer, `cmstp.exe`. The script generates an `.inf` file, launches `cmstp.exe` with the `/au` option, waits for the installer window to become active, and then uses simulated keystrokes to confirm execution, allowing a payload to run in an elevated context without a standard UAC prompt workflow. The repository attributes the technique to Oddvar Moe and indicates the code was forked by Tyler Applebaum, with comments describing possible stealth refinements and customizable command execution. A second referenced page appears unrelated to the UAC bypass activity and does not add material technical detail to the event, leaving the GitHub proof-of-concept as the primary source describing the exposed bypass method.
Aug 15, 2026
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
Security researchers detailed how attackers abuse Windows access tokens to impersonate users, elevate privileges, and move laterally across enterprise environments. The technique relies on the way Windows ties logon sessions, privileges, and cached credentials to access tokens, allowing an attacker with sufficient local rights to duplicate or impersonate another process token and launch a new process under that security context. One proof-of-concept shows a local administrator enabling **`SeDebugPrivilege`**, opening a privileged process such as **`winlogon.exe`**, duplicating its token, and using **`CreateProcessWithTokenW`** to spawn a process as **SYSTEM**. Additional analysis shows token manipulation extends beyond local privilege escalation into stealthier authentication abuse, including **NETONLY** logons, **Pass-the-Hash**, **Pass-the-Ticket**, and **Overpass-the-Hash**. Researchers said attackers can abuse Windows APIs such as **`LogonUserW`**, **`CreateProcessWithLogonW`**, **`DuplicateTokenEx`**, **`SetThreadToken`**, **`ImpersonateLoggedOnUser`**, and **`LsaCallAuthenticationPackage`** to create new logon sessions or alter authentication behavior without changing the visible local user context. Defenders were advised to watch for artifacts such as **Event ID 4624** with **LogonType 9** and to account for detection gaps where Kerberos ticket operations may occur without direct **LSASS** process access.
Aug 15, 2026