LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Eudcedit.exe

View source

Private Character Editor Windows Utility

UAC Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

UAC Bypass1

EXAMPLE 01T1548.002

Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option "Link with Selected Fonts" and click on Save As, then in the opened enter the command you want to execute.

COMMAND
eudcedit
USE CASE
Execute a binary or script as a high-integrity process without a UAC prompt.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMDApplication · GUI
02 / ON DISK

Known paths

c:\windows\system32\eudcedit.exe
c:\windows\syswow64\eudcedit.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    Processes spawned by eudcedit.exe.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matan Bahar@Bl4ckShad3