CatalogLOLBAS

LOL · Binary

Eudcedit.exe

1 techniqueWindowsLOLBASGPL-3.0

UAC Bypass

UAC BypassPrivilege EscalationWindows

Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option "Link with Selected Fonts" and click on Save As, then in the opened enter the command you want to execute.

Use Execute a binary or script as a high-integrity process without a UAC prompt.

eudcedit
Evidence
Upstream reference
Environment
Local host
Context
admin
Native
UAC Bypass
Detection
IOC: Processes spawned by eudcedit.exe.