UACMe

MITRE ATT&CK: S0116 View on attack.mitre.org

Aliases: Akagi

Malware type
exploit-kit
Related IoCs
215 (215 malicious)
Last IoC activity
2026-10-17 22:48:49
Profile updated
2026-07-07 15:45:37

Context

UACMe is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.

Recent IoC activity

215 malicious indicators in Maltiverse are attributed to UACMe (S0116). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample bec4c1ad4157790dc4ae5b602b665f9bc248c14ace84d5ce138490a00fa956d0 2026-10-17 1
file sample 235daf48393edb00edc3242728eac501c65d10cea0dce63854f6c6730bbec1b5 2026-10-17 1
file sample 4a7ae477aa1f8a8ae2c63374e977793a15319e9a12a2a5b2af06d950c5b9750f 2026-10-17 1
file sample 34a5f686df72852ef1eb7ea2ad5cb2d69a71ef27699940e74950fcbc7cca8a9a 2026-10-17 1
file sample 86858277bc1dd78cff4a6a85e5b95b228e274b03829cc0a419b21f0e3835a7dd 2026-10-17 1
file sample 9d9914b8166170973849a86402e7d71d8ec3b8437ac0e75fbcef4d2fabac55e0 2026-10-17 1
file sample 79ea337fec7af8b21f53f0990e1ed69077e8822dd6dc6cb30091480c9f6ecf7f 2026-10-17 1
file sample d33f4ba9e268fcd4e954b4ecf9e38d20c6b3d08ea27dd59c99df73507dabe567 2026-10-17 1
file sample 61781e571cd8177554db550b1e92611a5b883bee13a007862d35ec79b60466d7 2026-10-17 1
file sample c9099f656b2c19cd6683125d14e416359f7327f4ac2d3d51f4d0b6f40f858057 2026-10-17 1
file sample 97b2c0923c10d097468a1db446dcb031fb5de093dc2837b93659fc046def1d65 2026-10-17 1
file sample 3f14bc6bddeffc1e767802bdf25b06f15e178733ac72da1c26d4ff31d701120a 2026-10-17 1
file sample 31822d23e041bccdc3ace7fde73ca382f77e200ac827847e11fc99a03c2da6f3 2026-10-17 1
file sample eb6a002e82ac18f139ddab318a5a0e3c1fc642a0e8271de7da13e63ca098522f 2026-10-17 1
file sample 9a834449db186b6b05bfdc740ab3b55e671ca37e78484eb94074a262a7b1cf53 2026-10-17 1
file sample ec0722119c93e4e217ddc5398c36f51a33c0e6211f24ddcdc206fc9b41a21c9e 2026-10-17 1
file sample a93367bbd8ad8bbdf30b88176cfb91e590015760d80cee84632de7a5df7e4cc7 2026-10-17 1
file sample 8cbf3226575d7c30f519dfcb3507fa802e423e44daf07c4610287be86710207b 2026-10-17 1
file sample 63954169ea6386d3e2bb61dff26665506acd0c708934cd18776a544899d39959 2026-10-17 1
file sample cd1ba3139337b94b16424d2655789805cd8269c9c49bbb1e75ca12eca318b18f 2026-10-17 1

Detection coverage

  • 1 YARA rules
  • 56 Sigma rules

Malware & tools used

  • Bypass User Account Control (attack-pattern)

Detection rules

  • MALPEDIA_Win_Uacme_Auto (yara-rule)

Reports & references

  • Kaspersky — 90729 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Uacme (report)
  • github.com — Uacme (report)
  • MITRE ATT&CK — S0116 (report)

External references