UACME

UACMe is an open-source Windows privilege-escalation toolset focused on bypassing User Account Control (UAC) across multiple Windows versions. It is widely used as a proof-of-concept and operational utility to launch follow-on payloads with elevated privileges after initial compromise. The project implements numerous UAC bypass methods, including abuse of auto-elevated components, COM interfaces, registry hijacks, scheduled-task abuse, DLL hijacking, and other Windows-specific elevation paths, making it a flexible post-exploitation aid rather than a standalone intrusion platform.

The tool has been observed in real-world intrusions as a privilege-escalation component used by multiple threat actors and malware operators. Reported use includes ransomware affiliates, espionage campaigns, and North Korean-linked operations such as Lazarus- and Kimsuky-associated activity, where it was employed after phishing- or watering-hole-based compromise to obtain administrative execution for additional malware deployment, persistence, credential access, and remote-control tooling. It has also been referenced in campaigns that paired it with droppers, downloaders, backdoors, and remote administration malware.

UACMe targets Microsoft Windows systems and is best characterized as a post-compromise privilege-escalation utility. Its primary value to operators is defense evasion and privilege escalation by suppressing or bypassing standard elevation prompts, enabling subsequent payloads to run with higher integrity without requiring normal user approval flows.