skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-privilege-escalation-attempts

Detect privilege escalation attempts across Windows and Linux using SIEM and EDR telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#siem#sysmon#mitre att&ck#UAC bypass#Privilege escalation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-privilege-escalation-attempts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-privilege-escalation-attempts
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-privilege-escalation-attempts
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-privilege-escalation-attempts

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Privilege escalation techniques like token manipulation, UAC bypass, and unquoted service paths often evade default logging, leaving security teams blind to attackers moving from standard users to SYSTEM or root. This Skill provides a structured threat-hunting workflow with concrete detection guidance to surface these stealthy techniques.

Core Features & Use Cases

  • Technique Coverage: Detects MITRE ATT&CK techniques T1134 (Access Token Manipulation), T1548.002 (UAC Bypass), T1068 (Exploitation for Privilege Escalation), and T1574.009 (Unquoted Service Path).
  • Detection Gap Analysis: Documents blind spots such as missing Security EIDs for token abuse and silent UAC bypasses, with specific Sysmon and Windows Event IDs to hunt on.
  • Validation Workflow: Recommends Atomic Red Team tests (T1548.002, T1134.001) to confirm detections fire end-to-end and guidance for tuning false positives.
  • Use Case: A threat hunter investigating a suspected Potato-style token impersonation attack uses the workflow to query Sysmon EID 10 process-access events and 4688 token elevation events in Splunk, then documents findings in the standardized hunt report format.

Quick Start

Hunt for privilege escalation attempts on our Windows endpoints by checking Sysmon process-access events and token elevation logs for signs of fodhelper UAC bypass or token impersonation.

Frequently Asked Questions about detecting-privilege-escalation-attempts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect UAC bypass techniques like fodhelper?▼

Detect fodhelper and similar UAC bypasses by hunting Sysmon Event ID 12/13 registry modifications under HKCU\...\ms-settings\shell\open\command, plus Event ID 1 where auto-elevating binaries spawn cmd or powershell. Standard UAC consent events are noisy and usually disabled, so registry and process telemetry are the reliable sources.

How to detect access token manipulation attacks in Windows?▼

Detect token manipulation (T1134) using Sysmon Event ID 10 showing ProcessAccess to higher-integrity processes with access masks like 0x1410 or 0x1FFFFF, combined with Security Event 4688 showing TokenElevationType %%1937. Note that 4688 requires command-line auditing enabled to be visible.

What tools are needed for privilege escalation threat hunting?▼

You need an EDR platform such as CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne, plus a SIEM like Splunk, Elastic, or Sentinel. Sysmon with a comprehensive configuration and Windows Security Event Log forwarding are prerequisites for adequate telemetry.

Why are privilege escalation attempts hard to detect with default logging?▼

Techniques like SeDebugPrivilege abuse and DuplicateTokenEx rarely emit clean Security Event IDs, and UAC bypasses leave no consent events. Kernel exploits may only appear as application crash logs, so hunters must rely on Sysmon telemetry and correlation across multiple sources.

How do I validate that privilege escalation detections actually work?▼

Run Atomic Red Team tests for T1548.002 (fodhelper) and T1134.001 to confirm registry-set and token-elevation searches fire end-to-end. Tune false positives by baselining on parent process and signing status rather than binary name alone.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced