T1548.002

Bypass User Account Control

Sub-technique of T1548 Abuse Elevation Control Mechanism

Going from a medium-integrity administrator to high integrity without triggering the UAC prompt.

How it shows up on Hack The Box

If whoami /groups says you are an administrator but with a Medium Mandatory Label, you need a UAC bypass (fodhelper, eventvwr) before you can dump credentials.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.