THREAT OPS › Threat News › Bypassing Windows Administrator Protection
Bypassing Windows Administrator Protection
<p>A headline feature introduced in the latest release of Windows 11, 25H2 is <a href="https://blogs.windows.com/windowsdeveloper/2025/05/19/enhance-your-application-security-with-administrator-protection/">Administrator Protection</a>. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrato
Attributed threat actors
- Earth LuscaG1006
MITRE ATT&CK techniques
Indicators of compromise
- https://blogs.windows.com/windowsdeveloper/2025/05/19/enhance-your-application-security-with-administrator-protection/url
- https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.htmlurl
- https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-1.htmlurl
- https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.htmlurl
- https://project-zero.issues.chromium.org/issues?q=reporter:forshaw@google.com%20title:%22administrator%20protection%22url
- https://project-zero.issues.chromium.org/issues/432313668url
- https://project-zero.issues.chromium.org/issues/42451540url
- https://www.tiraniddo.dev/2024/02/sudo-on-windows-quick-rundown.htmlurl