ATT&CK T1548.002 - UAC Bypass Tool Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects the download of tools or files that contain 'uac' and 'bypass' in their HTTP URI. This is indicative of an attempt to download a User Account Control (UAC) bypass tool, which adversaries might use for privilege escalation on Windows systems.