Loading story…
A public GitHub repository exposes a PowerShell proof-of-concept for bypassing Windows User Account Control (UAC) by abusing the Microsoft Connection Manager Profile Installer, cmstp.exe. The script generates an .inf file, launches cmstp.exe with the /au option, waits for the installer window to become active, and then uses simulated keystrokes to confirm execution, allowing a payload to run in an elevated context without a standard UAC prompt workflow.
The repository attributes the technique to Oddvar Moe and indicates the code was forked by Tyler Applebaum, with comments describing possible stealth refinements and customizable command execution. A second referenced page appears unrelated to the UAC bypass activity and does not add material technical detail to the event, leaving the GitHub proof-of-concept as the primary source describing the exposed bypass method.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
A public PowerShell proof-of-concept for bypassing Windows User Account Control using cmstp.exe was published, showing creation of an INF file, launching cmstp with the /au option, and using SendKeys to press Enter in the CMSTP window. The script credits Oddvar Moe as the author and labels itself as a UAC bypass PoC.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers published multiple technical demonstrations showing how Windows **User Account Control (UAC)** can still be bypassed through complex elevation paths, including a method described by James Forshaw and a later public proof of concept, **`SspiUacBypass`**, that uses **SSPI Datagram Contexts** to obtain elevated execution. The GitHub project exposes C++ research code for the technique and links it to broader work on abusing Windows elevation mechanisms, underscoring that UAC bypass tradecraft remains publicly documented and reproducible for attackers as well as defenders. A separate review of Microsoft’s upcoming Windows 11 **Administrator Protection** feature says the redesign reduces exposure to common split-token and COM auto-elevation abuse by introducing per-user **"Shadow Admin"** accounts, but does not fully eliminate legacy elevation weaknesses. The analysis says some bypass avenues and risky behaviors still persist, including issues tied to **`LocalAccountTokenFilterPolicy`**, **`RunOnce`** auto-elevation behavior, and certain **UIAccess** interactions, leaving enterprises with a transitional model where newer protections coexist with older high-integrity token paths.
Jul 24, 2026
Multiple reports describe abuse of the Microsoft-signed `fodhelper.exe` binary to bypass Windows User Account Control on Windows 10 by hijacking the per-user registry path `HKCU\Software\Classes\ms-settings\Shell\Open\command`. In the documented technique, an attacker sets a malicious default command and an empty `DelegateExecute` value so that `fodhelper.exe`, which auto-elevates, launches attacker-controlled code with high integrity. Public proof-of-concept examples showed the method spawning elevated `cmd.exe` or PowerShell sessions, and noted that the bypass generally requires the user to already belong to the local Administrators group. The same technique was later observed in a phishing campaign analyzed by SANS, where a malicious Word document used embedded OLE objects instead of macros to trigger a batch file on victim systems. That script checked for Windows 10, attempted UAC bypass via `fodhelper.exe` and `eventvwr.exe`, then downloaded additional payloads from attacker-controlled infrastructure including `23.98.155.192` and `hpsj.firewall-gateway.net`. The infection chain ultimately deployed the **Octopus** backdoor, which used HTTP-based command and control with AES-encrypted communications and supported victim reporting, file download, PowerShell reset, and arbitrary command execution.
Aug 15, 2026
Public offensive tooling and research continue to show how attackers can weaken PowerShell defenses by bypassing **AMSI**, suppressing **Script Block Logging**, and evading **Constrained Language Mode**. MDSec documented several methods, including flipping the private `.NET` flag `System.Management.Automation.AmsiUtils.amsiInitFailed`, patching `amsi.dll` in memory, forcing `AmsiOpenSession` failures, altering cached Group Policy settings to disable logging, and clearing PowerShell's suspicious signature list to reduce forced logging. The techniques were later operationalized in tools such as **Stracciatella**, a C# runspace launcher that executes PowerShell while attempting to disable AMSI, ETW, and logging at startup, supports encoded input and named-pipe command delivery, and was promoted for use with frameworks including **Cobalt Strike** and **BOF.NET**. Separate research also showed that AMSI itself can be abused for persistence by registering a malicious **AMSI provider** DLL as a COM server under `HKLM`, allowing code to run whenever AMSI-inspected content matches a trigger while still returning `AMSI_RESULT_NOT_DETECTED`. In the demonstrated sample, the provider watched for a specific string and launched `calc.exe`, highlighting how AMSI can be turned from a scanning interface into an execution mechanism. Defenders were advised to monitor unsigned DLL loads by PowerShell and registry changes affecting AMSI provider and `InprocServer32` entries, as these tradecraft patterns can support stealthy post-exploitation and long-term Windows persistence.
Aug 15, 2026