UAC Bypass & Sentinel Detection Framework

A C++ security research project demonstrating Windows User Account Control (UAC) bypass techniques alongside a real-time memory and registry monitoring sentinel engine designed to detect and mitigate unauthorized privilege escalation attempts.

---

📌 Executive Summary

This project serves as a dual-sided security engineering study focusing on Windows execution mechanics, runtime memory protection, and registry hierarchy monitoring. It consists of two primary modules:

1. Proof-of-Concept Module (UAC_Bypass.cpp): Demonstrates runtime patching techniques for AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows), string obfuscation, and UAC elevation via Registry hijacked delegation (ms-settings / fodhelper.exe).
2. Sentinel Detection Module (UACBypassDetector.cpp): A high-speed system monitoring daemon that performs low-overhead memory integrity checks to identify patched system functions and monitors registry subtree operations to intercept, clean, and mitigate hijacking attempts in real time.

---

🛠️ System Architecture & Components

┌────────────────────────────────────────────────────────────────────────┐
│                        UAC Bypass Framework                            │
└───────────────────┬────────────────────────────────┬───────────────────┘
                    │                                │
                    ▼                                ▼
┌───────────────────────────────────────┐ ┌───────────────────────────────┐
│     PoC Module (UAC_Bypass.cpp)       │ │ Sentinel Module               │
│                                       │ │ (UACBypassDetector.cpp)       │
├───────────────────────────────────────┤ ├───────────────────────────────┤
│ • XOR Compile-Time Obfuscation        │ │ • Low-Latency Memory Scanner  │
│ • AMSI Patching (AmsiScanBuffer)      │ │   (50ms polling loop)         │
│ • ETW Patching (EtwEventWrite)        │ │ • In-Memory Signature Match   │
│ • Registry Hijack (ms-settings/CurVer)│ │ • HKCU Registry Sentinel      │
│ • COM Execution (IShellDispatch2)     │ │ • Active Process Mitigation   │
└───────────────────────────────────────┘ └───────────────────────────────┘

---

🔍 Technical Deep Dive

1. PoC Module (UAC_Bypass.cpp)

The PoC binary models common evasion and privilege escalation vectors for security analysis:

• Compile-Time & Dynamic XOR Obfuscation: String constants and API identifiers are obfuscated using simple XOR keying (0x37) to bypass static string inspection.
• AMSI & ETW Neutralization:
  • AMSI Patching: Dynamically locates AmsiScanBuffer within amsi.dll and writes a stub returns AMSI_RESULT_CLEAN / error override (0x80070057), effectively blinding runtime script scanning.
  • ETW Patching: Modifies the entry point of EtwEventWrite in ntdll.dll with a direct RET (0xC3) instruction to suppress user-mode event trace emission.
• Registry Redirection (ms-settings Hijack):
  • Registers a custom fake shell class (MyFakeSettings) under HKCU\Software\Classes\MyFakeSettings\Shell\Open\Command.
  • Sets up a redirection entry under HKCU\Software\Classes\ms-settings\CurVer pointing to MyFakeSettings.
  • Leverages fodhelper.exe (an auto-elevating Windows binary) which reads ms-settings registry configuration on startup without prompting for traditional UAC consent.
• COM Execution Delegation:
  • Instead of executing fodhelper.exe directly via ShellExecute, it interacts with COM interfaces (IShellWindows -> IShellDispatch2) to instantiate the target through explorer.exe, masking parent-child process relationships.

---

2. Sentinel Module (UACBypassDetector.cpp)

The sentinel engine is designed to act as an active endpoint response mechanism capable of identifying and terminating hostile processes.

• Memory Integrity Monitoring Engine:

  • Runs an asynchronous scanning thread with a high-frequency polling loop (50ms interval).
  • Obtains system process lists using EnumProcesses to minimize performance overhead compared to snapshot APIs.
  • Calculates target virtual addresses (ntdll!EtwEventWrite and amsi!AmsiScanBuffer) across running user-mode processes.
  • Scans target memory space using ReadProcessMemory to detect inline patches (0xC3 instructions or patched byte patterns).
  • Automatically issues TerminateProcess calls against processes exhibiting memory tampering.

• Registry Sentinel & Threat Neutralization:

  • Registers a non-blocking notification handle using RegNotifyChangeKeyValue on HKCU\Software\Classes.
  • Immediately flags unauthorized modifications to sensitive shell keys (e.g., ms-settings\CurVer).
  • Extracts registry-injected payload commands for audit logging.
  • Executes immediate cleanup (RegDeleteTreeW) to purge hijacked keys before target binaries finish executing.
  • Triggers a post-neutralization process sweep thread that monitors and terminates downstream processes spawned during the attack window (fodhelper.exe, computerdefaults.exe, etc.).

---

⚙️ Compilation & Build Instructions

Prerequisites

• Operating System: Windows 10/11 (x64)
• Compiler: Microsoft Visual C++ Compiler (MSVC) included with Visual Studio 2019/2022 or Build Tools.
• Windows SDK: Version 10.0 or higher.

Building via Visual Studio Command Prompt

1. Open the Developer Command Prompt for VS.
2. Navigate to the source code directory.
3. Compile the PoC Binary:

   cl.exe /EHsc /O2 UAC_Bypass.cpp /link advapi32.lib shell32.lib ole32.lib oleaut32.lib /OUT:UAC_Bypass.exe

4. Compile the Sentinel Binary:

   cl.exe /EHsc /O2 UACBypassDetector.cpp /link advapi32.lib psapi.lib /OUT:UACBypassDetector.exe

---

🚀 Execution & Verification Workflow

Test Scenario: Evaluating Sentinel Protection

1. Launch the Sentinel Engine: Run the detector in an elevated or standard administrator prompt:

   UACBypassDetector.exe

   The console will display initializations for the Memory Scanner and Registry Sentinel.

2. Run the PoC Simulation: In a separate prompt, execute the bypass executable:

   UAC_Bypass.exe

3. Expected Sentinel Output: The sentinel will instantly detect memory patching or registry key creation, terminate the offending process, clean the registry modifications, and record the telemetry into UAC_Bypass_Audit.txt.

---

📊 Telemetry & Audit Log Example

When an event is detected, UACBypassDetector writes detailed logs to UAC_Bypass_Audit.txt:

[2026-03-30 10:15:02.124] [INIT] Memory Integrity Scanner Active (AMSI & ETW, 50ms tick)
[2026-03-30 10:15:02.125] [INIT] Registry Sentinel Active. Monitoring for hijacks...
[2026-03-30 10:15:05.412] [MEMORY_SCAN] Detection: ETW Bypass (EtwEventWrite patched) in PID 4812 (C:\Path\To\UAC_Bypass.exe)
[2026-03-30 10:15:05.415] [MITIGATION] Killed process with tampered memory: PID 4812
[2026-03-30 10:15:05.420] [SCAN] Detection: ms-settings redirected to MyFakeSettings
[2026-03-30 10:15:05.422] [EXTRACT] Extracted Payload: powershell -NoP -NonI ...
[2026-03-30 10:15:05.425] [MITIGATION] Instantly neutralized registry keys.
[2026-03-30 10:15:05.426] [SENTINEL] Post-Neutralization Sweep Engaged (3s window).
[2026-03-30 10:15:08.430] [SENTINEL] Sweep complete.

---

🛡️ Defensive Remediation & Mitigations

Beyond running active endpoint sentinels, standard enterprise security controls can mitigate registry-based UAC bypasses:

1. Set UAC Level to Maximum: Set User Account Control to Always Notify. Auto-elevation mechanisms (like fodhelper.exe) will prompt for explicit administrative consent before launching.
2. Attack Surface Reduction (ASR) Rules: Enable Windows Defender ASR rules blocking child processes from auto-elevating Windows binaries.
3. Endpoint Detection and Response (EDR): Monitor for abnormal registry creations under HKCU\Software\Classes\ pointing to executable targets, specifically tracking modifications to ms-settings and CurVer entries.

---

⚠️ Disclaimer

This repository and associated source code are intended exclusively for educational, defensive security research, and authorized telemetry testing purposes. Running privilege escalation PoCs on systems without explicit prior authorization is prohibited.