Activity timeline
T1548.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 33 reports, and 78 of the 78 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1548.002 Bypass User Account Control is catalogued by MITRE ATT&CK under the Privilege Escalation tactic in the Enterprise matrix, as a sub-technique of T1548 Abuse Elevation Control Mechanism. Threadlinqs maps 78 of 2623 tracked threats (3%) to it; by severity that is 10 critical, 63 high, 5 medium.
Threats that use T1548.002 most often also use T1071.001 Web Protocols (59 threats), T1685 Disable or Modify Tools (52 threats), T1059.001 PowerShell (51 threats), T1082 System Information Discovery (49 threats), T1204.002 Malicious File (49 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
34 tracked threat actors appear in the threats that use T1548.002; the most frequent are Midnight Blizzard (4), UNC2452 (4), APT38 (3), Sapphire Sleet (3), Stardust Chollima (3).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1548.002.
Data sources
Telemetry that can reveal T1548.002, per MITRE ATT&CK.
- Command — Command Execution
- Process — Process Creation, Process Metadata
- Windows Registry — Windows Registry Key Modification
Threat actors using it
Tracked threats
The 30 most recent of 78 tracked threats that use T1548.002.
- Microsoft Defender Antivirus Exclusion Abuse: Attackers Set and Hide Exclusions…medium
- BlueLocker Ransomware Resurfaces After Three-Year Dormancy, Breaches Pakistan Petroleum Limitedhigh
- Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packageshigh
- Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal…high
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator…high
- MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2high
- CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)critical
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypasshigh
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C…medium
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi…high
- REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…high
- MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abusehigh
- D3F@ck Loader: JPHP-Based Malware-as-a-Service Loader Abuses Windows Defender Exclusions and…high
- Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and…high
- PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killerhigh
- HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)high
- Dragon Breath (APT-Q-27) Deploys RONINGLOADER to Disable Security Tools and Drop Gh0st RAThigh
- Coldcard Security Audit Phishing Campaign Installs ConnectWise ScreenConnect RATcritical
- SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote Accesshigh
- CaptiveCrunch Campaign — Storm-2945 Delivers ChocoShell/CornFlake Malware via Compromised Hotel Captive…high
- CaptiveCrunch: Russian SVR-Aligned Storm-2945 Hijacks Hotel Wi-Fi Captive Portals to Deploy CornFlake RAT…critical
- Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys QuasarRAT, UltraVNC and Updated Notifier Backdoorhigh
- CaptiveCrunch: Midnight Blizzard (Storm-2945) Hospitality Captive-Portal AiTM Campaignhigh
- CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver…high
- SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltrationhigh
- Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiledhigh
- BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency…high
- Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applicationshigh
- Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign)high
- Royal Ransomware Uses Qbot and Cobalt Strike to Rapidly Compromise Windows Domainshigh
Detection coverage
Threadlinqs maintains 142 detection rules mapped to T1548.002 (SPL 48, KQL 57, Sigma 37). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1548 Abuse Elevation Control Mechanism — 281 tracked threats at the technique level.