UAC PowerShell bypass techniques allow administrators and red teams to execute elevated commands while evading built-in Windows defenses. These methods exploit trust relationships, fileless execution paths, and weak application whitelisting to maintain stealth during assessments.
Understanding how User Account Control interacts with PowerShell is essential for both defenders hardening endpoints and attackers testing the depth of an environment. The following sections break down practical bypass strategies, mitigations, and detection guidance.
| Bypass Category | Technique | Execution Context | Evasion Level |
|---|---|---|---|
| COM Elevation | Event Subscriptions + SilentCleanup | System or high-integrity user | High |
| Module Injection | Reflective loading of PowerShell into trusted host | Medium integrity with trusted binary | Medium to High |
| Scheduled Task Abuse | Misconfigured tasks with highest privileges | SYSTEM or delegated admin context | High |
| Unencrypted Script Paths | Writable directories in %PATH% or temp locations | User context with write permissions | Low to Medium |
| AppX and Packaged Elevation | Side-load trusted app packages to gain elevation | User context with developer mode | High |
Abusing SilentCleanup and Event Subscriptions
How Trusted Processes Can Be Hijacked
Windows Task Scheduler includes a built-in task named SilentCleanup that runs with elevated privileges under the SYSTEM account. Attackers can register an event subscription that points to a malicious PowerShell script or wrapper, triggering execution at the next silent cleanup cycle. Because the task runs in a high-integrity context, bypassing UAC occurs without additional prompts, provided the subscription mechanism is writable by lower-privileged users.
Exploiting Scheduled Tasks with Highest Privileges
Weak ACLs and Service Misconfigurations
Many environments leave scheduled tasks configured with the highest privileges and weak file permissions, allowing non-privileged users to modify the action or trigger the task remotely. By replacing the executable or script path with a payload that launches PowerShell with encoded commands, attackers achieve a UAC bypass. Defenders should audit task ownership, ACLs, and ensure that triggers do not rely on predictable or controllable events.
Defensive Practices and Detection Guidance
Hardened Configuration and Monitoring
Securing UAC PowerShell bypass vectors requires a layered defense starting with least-privilege principles for users and services. Disabling unnecessary scheduled tasks, enforcing strong ACLs, and restricting where scripts can be stored reduce the attack surface. Endpoint detection rules should focus on unusual parent-child process chains involving PowerShell, scheduled task modifications, and COM event subscription creation.
Key Recommendations and Takeaways
- Audit scheduled tasks and event subscriptions for weak ACLs or paths writable by non-privileged users.
- Enforce application control and restrict PowerShell to approved scripts and approved hosts where possible.
- Implement robust logging for PowerShell, Task Scheduler, and COM registration events to detect suspicious activity.
- Apply updates and remove unnecessary trusted binaries that may be leveraged for module injection.
- Regularly review service configurations to eliminate unquoted service paths and unintended auto-elevate entries.
FAQ
Reader questions
How can I test whether my endpoints are vulnerable to UAC PowerShell bypass techniques?
Run a controlled assessment using approved tools that simulate COM hijacking, scheduled task abuse, and unquoted service paths, while monitoring for unexpected PowerShell invocations with elevated integrity.
What is the most reliable indicator of a UAC PowerShell bypass attempt in my environment?
Look for PowerShell processes spawned by non-interactive or system-level tasks, especially those using encoded commands or loading modules from temporary or writable locations.
Can Group Policy fully prevent these bypass techniques?
Group Policy can restrict PowerShell version, script execution, and logging, but it cannot automatically fix weak ACLs or remove overly permissive scheduled tasks; these require explicit configuration and ongoing review. Yes, local user permissions, writable paths, and default Windows tasks still enable UAC bypasses on standalone devices, making mitigation important for all endpoints.