UAC Bypass and Access Token Manipulation: Local Privilege Escalation

> Purpose and scope. This article maps Windows UAC bypass and access token

> manipulation techniques comprehensively for authorized penetration testing, red/purple

> team exercises, and defense (SOC/DFIR) teams: for each technique the *how-it-works

> → how-to-detect → how-to-prevent* triad is provided. Content is for educational

> and defensive purposes; concrete use of attack tools is provided only in the Lab Annex,

> for environments with explicit written authorization.

>

> Related articles: For process injection see [Process Injection]

> (process-injection); for credential dumping see [LSASS Credential Dumping]

> (lsass-kimlik-bilgisi-dokumu).

Executive Summary

UAC bypass and token manipulation are two distinct but frequently combined technique

families that allow an attacker to cross the "Medium Integrity" boundary on a local

machine and reach administrator or SYSTEM privileges.

> Core thesis. UAC, as Microsoft explicitly states in its own documentation,

> is not a security boundary — it is a convenience mechanism designed to protect

> users from accidentally performing administrator actions. This honest definition is

> the starting point for prioritizing defenses: instead of relying on the UAC layer alone,

> a least privilege architecture, EDR behavioral detection, and token monitoring layers

> must be built.

Three layers are covered in this article:

1. UAC architecture and bypass families — integrity levels, consent.exe flow,

auto-elevate technique, HKCU registry hijack family (fodhelper/computerdefaults/

eventvwr/sdclt), SilentCleanup env-var, Mock Trusted Directory.

1. Token model and manipulation techniques — primary vs. impersonation, T1134

sub-techniques, token theft API chain.

1. The "Potato" family — the path from SeImpersonatePrivilege to SYSTEM; JuicyPotato

→ RoguePotato → PrintSpoofer → GodPotato Windows version matrix.

1. UAC Architecture: Integrity Levels and the Split Token

#### 1.1 Integrity Levels

**Mandatory Integrity Control**, introduced with Windows Vista,

assigns an integrity label to every process and securable object. This label

is an additional access control layer independent of object ownership and ACLs.

#### 1.2 Split Token Model

When a member of the local Administrators group logs in to Windows (with UAC enabled), the OS

creates two linked tokens:

• Filtered (Medium-IL) Token: Administrator group memberships disabled, most

privileges removed. explorer.exe and all normal user processes start with this

token.

• Full (High-IL) Token: All group memberships and privileges active. Linked

to the filtered token via the LinkedToken field in kernel memory; used only

via UAC approval or the auto-elevate mechanism.

Exception: The built-in Administrator account with RID 500 (even if renamed)

always runs with the full token unless FilterAdministratorToken=1 is set.

#### 1.3 consent.exe and AppInfo Service (AIS) Flow

When a process requests elevation:

1. The shell calls the RAiLaunchAdminProcess RPC method in appinfo.dll (AppInfo service).
2. appinfo.dll reads the executable's application manifest; checks the requestedExecutionLevel and autoElevate attributes.
3. If the file is Microsoft-signed and carries autoElevate="true", it is elevated without showing a dialog.
4. Otherwise consent.exe is launched; a consent dialog is shown to the user.
5. If consent is granted, the process is started with the linked full (High-IL) token.

> Auto-elevate conditions: Trusted directory (C:\Windows\System32\,

> C:\Program Files\) + Microsoft signature + autoElevate=true manifest attribute.

> Simulating or spoofing this triad via registry is the fundamental method of UAC bypass

> attacks.

2. UAC Bypass Families (T1548.002)

#### 2.1 HKCU Registry Hijack: fodhelper / computerdefaults

fodhelper.exe (C:\Windows\System32\fodhelper.exe) and computerdefaults.exe

are Microsoft-signed executables with autoElevate=true manifests. When launched,

they read certain HKCU keys; since these keys are writable with user permissions,

they can be modified by a standard Medium-IL process.

Working mechanism (fodhelper/computerdefaults):

Attacker (Medium-IL) →
  HKCU\Software\Classes\ms-settings\Shell\Open\command → (default) = cmd.exe
  HKCU\Software\Classes\ms-settings\Shell\Open\command → DelegateExecute = (empty)
↓
fodhelper.exe is launched (automatic High-IL elevation) →
  Shell API looks up the ms-settings handler →
  HKCU\...\ms-settings\... is scanned first →
  cmd.exe → runs as High-IL child

The same mechanism applies to computerdefaults.exe. UACMe methods #33, #62, #70

belong to this family and are marked as still unfixed as of v3.7.0 (May 2026).

Behavioral trace:

• fodhelper.exe or computerdefaults.exe → high-integrity child process
• Parent-child: medium-IL process → fodhelper/computerdefaults → high-IL command line
• Registry write: HKCU\Software\Classes\ms-settings\Shell\Open\command (Sysmon EID 12/13)

#### 2.2 eventvwr.exe (mscfile Handler Hijack)

eventvwr.exe (Event Viewer) is a Microsoft auto-elevated executable.

When launched, it checks the HKCU shell handler for .msc files.

HKCU\Software\Classes\mscfile\shell\open\command → cmd.exe
eventvwr.exe is launched (High-IL auto-elevate) →
  eventvwr.exe calls the .msc handler to open mmc.exe →
  HKCU handler takes priority → cmd.exe runs as High-IL

UACMe method #13 (DLL hijack variant) was patched in Windows 10 RS1 and

removed in v3.5.0. The registry hijack variant is documented under a different technique number.

#### 2.3 sdclt.exe (Multiple Variants)

sdclt.exe (Windows Backup) has harbored multiple auto-elevate vulnerabilities:

• Control Panel path variant: HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe
• Isolated command variant: HKCU\Software\Classes\exefile\shell\runas\command\isolatedCommand

(UACMe #31 — patched in RS4, removed in v3.5.0)

UACMe #53 is marked as still unfixed as of v3.7.0.

#### 2.4 SilentCleanup / Environment Variable Technique

The Windows scheduled task SilentCleanup runs with SYSTEM privileges

and expands the %windir% environment variable. Since environment variables

can be edited in user scope:

HKCU\Environment\windir → C:\windows\system32\cmd.exe &&REM 
↓
SilentCleanup is triggered →
  %windir%\system32\cleanmgr.exe →
  %windir% is expanded → cmd.exe runs (in SYSTEM context)

Web verification: This technique remains active as of 2025-2026; the Splunk detection rule

was updated in May 2026. UACMe #34 is marked as unfixed in v3.7.0.

#### 2.5 Mock Trusted Directory (with DLL Hijack)

This technique exploits a path normalization inconsistency in appinfo.dll:

1. A directory \\?\C:\Windows \System32\ (with a trailing space) is created.
2. A Microsoft-signed, auto-elevate binary (e.g. winSAT.exe) is copied into this directory;

a malicious DLL is placed alongside it.

1. When appinfo.dll evaluates the path, GetLongPathNameW removes the space → it maps

to the trusted directory → validation passes.

1. The malicious DLL is loaded at High-IL.

Patch status (web verification): UACMe #52 is patched as of **Windows 11 24H2/25H2 (build 26100/

26200)**; removed in v3.7.0. The technique may still be applicable on Windows 10 and Windows 11

22H2 or earlier; does not work on current builds.

> Common denominator of UAC families. The common structure in all registry hijack techniques

> is: a medium-IL process writes under HKCU, the auto-elevate binary reads that key

> and executes the malicious command at High-IL. UACMe (hfiref0x), as of v3.7.0,

> has 82 documented methods; some methods are patched ("removed"),

> a significant number ("unfixed") remain active.

3. Token Model and Manipulation Techniques (T1134)

#### 3.1 Primary vs. Impersonation Token

Primary Token: The primary security context associated with a process.

The CreateProcess, CreateProcessWithTokenW, CreateProcessAsUserW APIs use this

token.

Impersonation Token: Allows a thread to temporarily assume the context of another user.

The SetThreadToken, ImpersonateLoggedOnUser,

ImpersonateNamedPipeClient APIs assign this token.

Converting an impersonation token to a primary token requires DuplicateTokenEx;

this is why it is central to token manipulation.

#### 3.2 Token Contents

The TOKEN_PRIVILEGES, TOKEN_GROUPS, TOKEN_USER, TOKEN_ORIGIN, TOKEN_STATISTICS

structures form the contents of a token. Each privilege (SeDebugPrivilege,

SeImpersonatePrivilege, etc.) consists of a LUID (Locally Unique Identifier) and attribute

(Enabled / Disabled / EnabledByDefault) pair. The whoami /priv command

displays this structure in human-readable form.

#### 3.3 T1134.001 — Token Theft and Impersonation

Stealing the token of a running process to launch a new process. Required

access: Local Administrator.

API chain (token theft → SYSTEM):

OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, target_PID)
  ↓
OpenProcessToken(hProcess, TOKEN_DUPLICATE | TOKEN_QUERY, &hToken)
  ↓
DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL,
                 SecurityAnonymous, TokenPrimary, &hDupToken)
  ↓
AdjustTokenPrivileges(hDupToken, FALSE, &PrivsToken, ...)
  // SeAssignPrimaryTokenPrivilege (LUID 0x03) is enabled
  ↓
ImpersonateLoggedOnUser(hDupToken)
// or:
CreateProcessWithTokenW(hDupToken, 0, NULL, "cmd.exe", ...)
  → cmd.exe in SYSTEM context

This method is the mechanism Meterpreter's getsystem command uses under the hood.

runas /netonly: Creates a token for performing network operations with different credentials;

the local UI continues to run in the current user context. Can be abused in pass-the-token

scenarios.

#### 3.4 T1134.002 — Create Process with Token

The CreateProcessWithTokenW API starts a new process with an existing token.

In T1134.001 the token is assigned to a thread; in T1134.002 the target is directly

creating a new process.

Detection: Windows Security Event 4688 (new process creation), mismatch of

the creating and created process's SubjectUserSid / TargetLogonId; Sysmon EID 1

LogonGuid correlation.

#### 3.5 T1134.003 — Make and Impersonate Token

Creating a token from scratch rather than stealing an existing session token. The

LogonUser API is called with known credentials; the returned token is applied via

SetThreadToken or ImpersonateLoggedOnUser.

Key distinction: T1134.001 steals an existing token; T1134.003 creates a new token from credentials.

Detection: Windows Security Event 4624 (new logon), LogonType 9 (NewCredentials,

runas /netonly), parent and child process carrying different LogonGuid in Sysmon EID 1.

#### 3.6 T1134.005 — SID-History Injection

In Active Directory, the SID-History attribute is designed to preserve access rights

during domain migrations. An attacker with domain administrator privileges injects a

highly privileged SID (e.g. Enterprise Admins S-1-5-21-...-519) into the SID-History

of a low-privileged user; since this SID is included in the user's token, access

checks respond with Enterprise Admin authority. This technique is classified under T1134.005.

Tool: Mimikatz misc::addsid

Detection: Windows Security Event 5136 (directory service object attribute modification),

DsAddSidHistory API call monitoring, unexpected highly privileged SID content in logon token.

4. SeImpersonatePrivilege and the "Potato" Family

#### 4.1 Why is SeImpersonatePrivilege Dangerous?

SeImpersonatePrivilege allows a process to impersonate another user.

Application service accounts such as IIS, MSSQL, Exchange, and WCF have this privilege

by default — it is required for the service to impersonate its clients.

The problem: Attacker code running as a service (web shell, SQL injection) inherits this

privilege. If a process with SeImpersonatePrivilege finds a mechanism to impersonate SYSTEM,

the whoami output changes instantly.

> Chain summary: Service account (IIS/MSSQL) →

> SeImpersonatePrivilege present → set a trap to create a SYSTEM token →

> ImpersonateNamedPipeClient / AcceptSecurityContext → SYSTEM

#### 4.2 Evolution of the Potato Family

PrintSpoofer note (web verification): The original itm4n/PrintSpoofer repository was

archived in September 2024. However, the technique remains valid on Windows 11 and Server 2022

via the Print Workflow/PrintNotify service

(PrintWorkflowUserSvc). Even if the Spooler (spoolsv.exe) is disabled, the attack surface

does not close if PrintNotify service is present.

GodPotato note: GitHub README confirms Windows 8–11 / Server 2012–2022 scope.

No CVE reference. SigmaPotato (fork) is still actively developed in 2025.

#### 4.3 Working Mechanism (General Principle)

All Potato variants follow the same principle:

1. Force SYSTEM authentication: A service under SYSTEM account control is forced,

via COM/RPC/DCOM/ALPC/Pipe, to authenticate to an endpoint controlled by the attacker.

1. Capture the token: The SYSTEM token is obtained from the incoming connection via

ImpersonateNamedPipeClient or AcceptSecurityContext.

1. Elevate to SYSTEM: A new SYSTEM process is launched via DuplicateTokenEx + CreateProcessWithTokenW.

Behavioral trace:

• Named pipe server creation → SYSTEM connection expected
• Unexpected SYSTEM → service account parent chain
• Unexpected child process elevation from a service account with SeImpersonatePrivilege enabled

5. Lab Annex (Authorized Test Environment Only)

> This section is for explicitly authorized lab/penetration testing only.

# UAC Bypass — fodhelper HKCU registry hijack (conceptual)
# New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
# New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
#   -Name "DelegateExecute" -Value "" -Force
# Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
#   -Name "(default)" -Value "cmd.exe" -Force
# Start-Process "C:\Windows\System32\fodhelper.exe"
# NOTE: These lines are captured by EDR + Sysmon EID 12/13

// Token theft (conceptual — TokenThief-like)
// OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, SYSTEM_PID)
// OpenProcessToken(..., TOKEN_DUPLICATE | TOKEN_QUERY, ...)
// DuplicateTokenEx(..., TOKEN_ALL_ACCESS, ..., TokenPrimary, ...)
// AdjustTokenPrivileges (SeAssignPrimaryTokenPrivilege LUID=0x03)
// CreateProcessAsUserW(..., "cmd.exe", ...)
// Tool example: Metasploit post/multi/manage/shell_to_meterpreter (getsystem)

# GodPotato (conceptual — authorized lab, requires SeImpersonatePrivilege)
# GodPotato.exe -cmd "cmd /c whoami"

# UACMe research (binary analysis)
# strings.exe C:\Windows\System32\*.exe | findstr /i autoElevate
# → binaries containing autoElevate=true are UAC bypass target candidates