Skip to content

v1.2.0 - UAC Bypass Module

Choose a tag to compare

View all tags
@projectmerai projectmerai released this 05 Mar 07:56
· 41 commits to main since this release
v1.2.0
286638c

What's New

UAC Bypass Discovery

  • Manifest AutoElevate scanning — Finds EXEs with <autoElevate>true</autoElevate> manifests
  • COM AutoElevation scanning — Discovers COM objects with Elevation\Enabled=1 (Fodhelper, CMSTPLUA, etc.)
  • Side-load simulation — Simulates copy-to-writable-folder attack for unprotected AutoElevate binaries
  • New uac-bypass scan profile — Focused UAC bypass scanning

Improvements

  • Parallel System32 scanning with Parallel.ForEach
  • XML-validated manifest detection (fewer false positives)
  • +10 confidence bonus for UAC bypass candidates
  • WritabilityFilter auto-passes simulated copy attacks
  • 5 new tests for UAC bypass scoring

Bug Fixes

  • Fixed missing UACBypass in TriggerType enum
  • Fixed ExecutionContext → DiscoveryContext naming
  • Fixed TriggerAutoElevate defaulting to true

Other

  • README rewritten with updated documentation
Assets 3
Loading