# T1548.002 Bypass User Account Control

> As of 2026-10-05, T1548.002 (Bypass User Account Control) appears in 78 tracked threats, first reported 2026-02-20 and most recently 2026-10-01, with linked actors including Midnight Blizzard, UNC2452, APT38; it most often appears alongside T1071.001 (Web Protocols).

- **Tracked threats:** 78 (10 critical, 63 high, 5 medium)
- **First seen:** 2026-02-20
- **Last seen:** 2026-10-01
- **Threat actors:** 34
- **Detection rules:** 142 (counts only; Blue tier and above)

## Key facts

- **ID:** T1548.002
- **Framework:** MITRE ATT&CK
- **Tactics:** Privilege Escalation
- **Matrix:** Enterprise
- **Parent:** T1548
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1548/002/

## Activity timeline

T1548.002 first appeared in tracked threats on 2026-02-20 and was most recently reported on 2026-10-01. The busiest month was 2026-07 with 33 reports, and 78 of the 78 threats were reported in the twelve months to 2026-10.

## How adversaries use it

T1548.002 Bypass User Account Control is catalogued by MITRE ATT&CK under the Privilege Escalation tactic in the Enterprise matrix, as a sub-technique of [T1548 Abuse Elevation Control Mechanism](https://intel.threadlinqs.com/technique/T1548). Threadlinqs maps 78 of 2623 tracked threats (3%) to it; by severity that is 10 critical, 63 high, 5 medium.

Threats that use T1548.002 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (59 threats), [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (52 threats), [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (51 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (49 threats), [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (49 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

34 tracked threat actors appear in the threats that use T1548.002; the most frequent are [Midnight Blizzard](https://intel.threadlinqs.com/actor/Midnight%20Blizzard) (4), [UNC2452](https://intel.threadlinqs.com/actor/UNC2452) (4), [APT38](https://intel.threadlinqs.com/actor/APT38) (3), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (3), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (3).

## Mitigations

MITRE ATT&CK lists 4 mitigations for T1548.002.

- [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/)
- [M1047 Audit](https://attack.mitre.org/mitigations/M1047/)
- [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/)
- [M1052 User Account Control](https://attack.mitre.org/mitigations/M1052/)

## Data sources

Telemetry that can reveal T1548.002, per MITRE ATT&CK.

- Command — Command Execution
- Process — Process Creation, Process Metadata
- Windows Registry — Windows Registry Key Modification

## Threat actors using it

- [Midnight Blizzard](https://intel.threadlinqs.com/actor/Midnight%20Blizzard) — 4
- [UNC2452](https://intel.threadlinqs.com/actor/UNC2452) — 4
- [APT38](https://intel.threadlinqs.com/actor/APT38) — 3
- [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 3
- [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 3
- [UAT-11795](https://intel.threadlinqs.com/actor/UAT-11795) — 3
- [APT29](https://intel.threadlinqs.com/actor/APT29) — 2
- [Kontraktnik](https://intel.threadlinqs.com/actor/Kontraktnik) — 2
- [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 2
- [Nightmare Eclipse](https://intel.threadlinqs.com/actor/Nightmare%20Eclipse) — 2
- [Safepay](https://intel.threadlinqs.com/actor/Safepay) — 2
- [Storm-2945](https://intel.threadlinqs.com/actor/Storm-2945) — 2

## Tracked threats

The 30 most recent of 78 tracked threats that use T1548.002.

- [Microsoft Defender Antivirus Exclusion Abuse: Attackers Set and Hide Exclusions…](https://intel.threadlinqs.com/threat/TL-2026-2828) — medium — 2026-10-01
- [BlueLocker Ransomware Resurfaces After Three-Year Dormancy, Breaches Pakistan Petroleum Limited](https://intel.threadlinqs.com/threat/TL-2026-2667) — high — 2026-09-26
- [Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packages](https://intel.threadlinqs.com/threat/TL-2026-2665) — high — 2026-09-26
- [Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal…](https://intel.threadlinqs.com/threat/TL-2026-2664) — high — 2026-09-26
- [Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator…](https://intel.threadlinqs.com/threat/TL-2026-2602) — high — 2026-09-21
- [MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2](https://intel.threadlinqs.com/threat/TL-2026-2560) — high — 2026-09-18
- [CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)](https://intel.threadlinqs.com/threat/TL-2026-2533) — critical — 2026-09-16
- [Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass](https://intel.threadlinqs.com/threat/TL-2026-2481) — high — 2026-09-13
- [Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C…](https://intel.threadlinqs.com/threat/TL-2026-2469) — medium — 2026-09-12
- [Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi…](https://intel.threadlinqs.com/threat/TL-2026-2446) — high — 2026-09-11
- [REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…](https://intel.threadlinqs.com/threat/TL-2026-2353) — high — 2026-09-02
- [MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abuse](https://intel.threadlinqs.com/threat/TL-2026-2288) — high — 2026-09-02
- [D3F@ck Loader: JPHP-Based Malware-as-a-Service Loader Abuses Windows Defender Exclusions and…](https://intel.threadlinqs.com/threat/TL-2026-2147) — high — 2026-08-25
- [Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and…](https://intel.threadlinqs.com/threat/TL-2026-2091) — high — 2026-08-21
- [PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killer](https://intel.threadlinqs.com/threat/TL-2026-2055) — high — 2026-08-18
- [HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)](https://intel.threadlinqs.com/threat/TL-2026-2013) — high — 2026-08-14
- [Dragon Breath (APT-Q-27) Deploys RONINGLOADER to Disable Security Tools and Drop Gh0st RAT](https://intel.threadlinqs.com/threat/TL-2026-1996) — high — 2026-08-12
- [Coldcard Security Audit Phishing Campaign Installs ConnectWise ScreenConnect RAT](https://intel.threadlinqs.com/threat/TL-2026-1896) — critical — 2026-08-05
- [SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote Access](https://intel.threadlinqs.com/threat/TL-2026-1880) — high — 2026-08-04
- [CaptiveCrunch Campaign — Storm-2945 Delivers ChocoShell/CornFlake Malware via Compromised Hotel Captive…](https://intel.threadlinqs.com/threat/TL-2026-1857) — high — 2026-08-04
- [CaptiveCrunch: Russian SVR-Aligned Storm-2945 Hijacks Hotel Wi-Fi Captive Portals to Deploy CornFlake RAT…](https://intel.threadlinqs.com/threat/TL-2026-1853) — critical — 2026-08-04
- [Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys QuasarRAT, UltraVNC and Updated Notifier Backdoor](https://intel.threadlinqs.com/threat/TL-2026-1833) — high — 2026-08-03
- [CaptiveCrunch: Midnight Blizzard (Storm-2945) Hospitality Captive-Portal AiTM Campaign](https://intel.threadlinqs.com/threat/TL-2026-2765) — high — 2026-07-31
- [CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-1808) — high — 2026-07-31
- [SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-1728) — high — 2026-07-27
- [Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled](https://intel.threadlinqs.com/threat/TL-2026-1721) — high — 2026-07-27
- [BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency…](https://intel.threadlinqs.com/threat/TL-2026-1719) — high — 2026-07-27
- [Dolphin X Stealer: AI-Profiled Windows Infostealer/RAT Targeting 300+ Applications](https://intel.threadlinqs.com/threat/TL-2026-1698) — high — 2026-07-25
- [Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign)](https://intel.threadlinqs.com/threat/TL-2026-1645) — high — 2026-07-22
- [Royal Ransomware Uses Qbot and Cobalt Strike to Rapidly Compromise Windows Domains](https://intel.threadlinqs.com/threat/TL-2026-1626) — high — 2026-07-22

## Related CVEs

CVEs referenced by the tracked threats that use T1548.002, most frequent first.

- [CVE-2017-0199](https://intel.threadlinqs.com/cve/CVE-2017-0199)
- [CVE-2018-0802](https://intel.threadlinqs.com/cve/CVE-2018-0802)
- [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688)
- [CVE-2020-1472](https://intel.threadlinqs.com/cve/CVE-2020-1472)
- [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684)
- [CVE-2023-20598](https://intel.threadlinqs.com/cve/CVE-2023-20598)
- [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997)
- [CVE-2023-36025](https://intel.threadlinqs.com/cve/CVE-2023-36025)
- [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831)
- [CVE-2025-24054](https://intel.threadlinqs.com/cve/CVE-2025-24054)
- [CVE-2025-33053](https://intel.threadlinqs.com/cve/CVE-2025-33053)
- [CVE-2026-12957](https://intel.threadlinqs.com/cve/CVE-2026-12957)
- [CVE-2026-12958](https://intel.threadlinqs.com/cve/CVE-2026-12958)
- [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513)
- [CVE-2026-24294](https://intel.threadlinqs.com/cve/CVE-2026-24294)
- [CVE-2026-84869](https://intel.threadlinqs.com/cve/CVE-2026-84869)

## Detection coverage

Threadlinqs maintains 142 detection rules mapped to T1548.002 (SPL 48, KQL 57, Sigma 37). Rule content is available to Blue tier accounts and above; this page shows counts only.

142 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Parent technique

[T1548 Abuse Elevation Control Mechanism](https://intel.threadlinqs.com/technique/T1548) — 281 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1548.002
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)