skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-t1548-abuse-elevation-control-mechanism

Detect UAC bypass, sudo exploitation, and setuid abuse via registry and process monitoring.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#splunk#sigma#detection engineering#UAC bypass#Privilege escalation#mitre t1548
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-t1548-abuse-elevation-control-mechanism
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-t1548-abuse-elevation-control-mechanism
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-t1548-abuse-elevation-control-mechanism
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-t1548-abuse-elevation-control-mechanism

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers routinely bypass User Account Control and abuse Linux elevation mechanisms to gain administrative privileges without triggering alerts, leaving defenders blind to privilege escalation. This Skill provides detection logic, hunting queries, and validation steps to surface MITRE ATT&CK T1548 abuse across Windows and Linux environments.

Core Features & Use Cases

  • Registry-Based UAC Bypass Detection: Monitor Sysmon Event IDs 12/13 for modifications to HKCU\Software\Classes keys such as ms-settings and mscfile used by fodhelper and eventvwr bypasses.
  • Auto-Elevating Process Abuse Hunting: Detect fodhelper.exe, computerdefaults.exe, sdclt.exe, and cmstp.exe spawning unexpected child processes like cmd.exe or powershell.exe.
  • Cross-Platform Coverage: Includes Linux detection for setuid/setgid abuse and sudo misconfiguration exploitation via auditd execve monitoring.
  • Use Case: A threat hunter investigating how an attacker obtained admin rights without a UAC prompt runs the included Splunk, KQL, and Sigma queries to identify registry hijacks and integrity-level jumps, then validates coverage with Atomic Red Team T1548.002 tests.

Quick Start

Hunt for UAC bypass activity on my Windows endpoints by checking registry modifications under HKCU\Software\Classes and auto-elevating binaries spawning suspicious child processes.

Frequently Asked Questions about detecting-t1548-abuse-elevation-control-mechanism

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect UAC bypass techniques like fodhelper abuse?▼

Monitor Sysmon Event IDs 12 and 13 for registry writes to HKCU\Software\Classes\ms-settings\shell\open\command, then correlate with Event ID 1 where fodhelper.exe spawns cmd.exe or powershell.exe at High integrity. The Skill includes ready-to-use Splunk, KQL, and Sigma queries for this.

What telemetry is required to detect T1548 privilege escalation?▼

You need Sysmon Event ID 1 with command-line and parent process logging, Windows Security Event ID 4688, Sysmon registry events 12/13 for HKCU\Software\Classes keys, and auditd execve logging on Linux. Without registry auditing, fileless UAC bypasses remain silent.

Does this detection cover Linux privilege escalation?▼

Yes, it covers T1548.001 setuid/setgid abuse and T1548.003 sudo exploitation using auditd execve rules and /etc/sudoers file watches. These detections require auditd to be deployed and shipping logs.

Why do some UAC bypasses not trigger detection?▼

Fileless bypasses using empty DelegateExecute values or CurVer redirection evade string-match rules on ms-settings, and CMSTP-based bypasses drop an INF file instead of writing registry keys. Detection requires registry auditing plus child-process correlation rather than binary name matching alone.

How do I validate my UAC bypass detection coverage?▼

Run Atomic Red Team tests for T1548.002 covering fodhelper, sdclt, and CMSTP scenarios, then confirm the Sysmon registry searches and child-process searches fire. Tune false positives by baselining on consent.exe presence and signed payloads rather than binary names.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced
florianbuetowflorianbuetow
12

mitre

Map security findings to MITRE ATT&CK tactics and techniques.

Community
Advanced
jmaglyjmagly
175

log-analysis

Correlate authentication, system, application, and web server logs to detect attacker activity patterns.

Community
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced