detecting-t1548-abuse-elevation-control-mechanism skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Detect abuse of elevation control mechanisms (T1548), including Windows UAC Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1548-abuse-elevation-control-mechanism, or copy the skill folder into ~/.claude/skills/detecting-t1548-abuse-elevation-control-mechanism/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md

SKILL.md (verbatim)

name: detecting-t1548-abuse-elevation-control-mechanism
description: Detect abuse of elevation control mechanisms (T1548), including Windows UAC
  bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation,
  by monitoring registry changes, integrity-level transitions, and parent-child process
  relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation
  activity or validating elevation-abuse detection coverage.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- uac-bypass
- privilege-escalation
- mitre-t1548
- elevation-control
- windows-security
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Restore Access
- Password Authentication
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1548.002
- T1548.001
- T1548.003
- T1548.004

Detecting T1548 Abuse Elevation Control Mechanism

When to Use

  • When hunting for privilege escalation via UAC bypass in Windows environments
  • After threat intelligence indicates use of UAC bypass exploits by active threat groups
  • When investigating how attackers achieved administrative access without triggering UAC prompts
  • During security assessments to validate UAC bypass detection coverage
  • When monitoring for setuid/setgid abuse on Linux systems

Prerequisites

  • Sysmon Event ID 1 with command-line and parent process logging
  • Windows Security Event ID 4688 with process tracking
  • Registry auditing for UAC-related keys (HKCU\Software\Classes)
  • Sysmon Event ID 12/13 (Registry key/value modification)
  • EDR with elevation monitoring capabilities

Workflow

  1. Monitor UAC Registry Modifications: Many UAC bypasses modify registry keys under HKCU\Software\Classes\ms-settings\shell\open\command or HKCU\Software\Classes\mscfile\shell\open\command. Track Sysmon Events 12/13 for these changes.
  2. Detect Auto-Elevating Process Abuse: Certain Windows binaries auto-elevate without UAC prompts (fodhelper.exe, computerdefaults.exe, eventvwr.exe). Hunt for these being launched by non-standard parent processes.
  3. Track Process Integrity Level Changes: Monitor for processes escalating from medium to high integrity level without corresponding UAC consent events.
  4. Hunt for Elevated Process Spawning: Detect when auto-elevating processes spawn unexpected children (cmd.exe, powershell.exe) -- indicating UAC bypass exploitation.
  5. Monitor Linux Elevation Abuse: Track sudo misconfiguration exploitation, setuid binary abuse, and capability manipulation.
  6. Correlate with Privilege Escalation Chain: Map elevation abuse to the broader attack chain, identifying what was done with escalated privileges.

Key Concepts

Concept Description
T1548.002 Bypass User Account Control
T1548.001 Setuid and Setgid (Linux)
T1548.003 Sudo and Sudo Caching
T1548.004 Elevated Execution with Prompt (macOS)
UAC Auto-Elevation Windows binaries that elevate without prompt
fodhelper.exe Common UAC bypass vector via registry hijack
eventvwr.exe MSC file handler UAC bypass
Integrity Level Windows process trust level (Low/Medium/High/System)

Detection Queries

Splunk -- UAC Bypass via Registry Modification

index=sysmon (EventCode=12 OR EventCode=13)
| where match(TargetObject, "(?i)HKCU\\\\Software\\\\Classes\\\\(ms-settings|mscfile|exefile|Folder)\\\\shell\\\\open\\\\command")
| table _time Computer User EventCode TargetObject Details Image

Splunk -- Auto-Elevating Process Abuse

index=sysmon EventCode=1
| where match(Image, "(?i)(fodhelper|computerdefaults|eventvwr|sdclt|slui|cmstp)\.exe$")
| where NOT match(ParentImage, "(?i)(explorer|svchost|services)\.exe$")
| table _time Computer User Image CommandLine ParentImage ParentCommandLine

KQL -- UAC Bypass Detection

DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any ("ms-settings\\shell\\open\\command", "mscfile\\shell\\open\\command")
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName

Sigma Rule

title: UAC Bypass via Registry Modification
status: stable
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains:
            - '\ms-settings\shell\open\command'
            - '\mscfile\shell\open\command'
            - '\exefile\shell\open\command'
    condition: selection
level: high
tags:
    - attack.privilege_escalation
    - attack.t1548.002

Common Scenarios

  1. fodhelper.exe Registry Hijack: Attacker sets HKCU\Software\Classes\ms-settings\shell\open\command to a malicious executable, then launches fodhelper.exe which auto-elevates and executes the hijacked command.
  2. eventvwr.exe MSC Bypass: Modifying HKCU\Software\Classes\mscfile\shell\open\command to intercept Event Viewer's auto-elevation behavior.
  3. sdclt.exe Bypass: Leveraging the Windows Backup utility's auto-elevation to execute arbitrary commands.
  4. CMSTP.exe INF Bypass: Using Connection Manager Profile Installer with a malicious INF file to bypass UAC via /s /ni flags.
  5. DLL Hijacking in Auto-Elevate: Placing malicious DLLs in search paths of auto-elevating executables.

Output Format

Hunt ID: TH-UAC-[DATE]-[SEQ]
Host: [Hostname]
Bypass Method: [Registry hijack/DLL hijack/Token manipulation]
Auto-Elevate Binary: [fodhelper.exe/eventvwr.exe/etc.]
Registry Key Modified: [Full registry path]
Payload Executed: [Command or binary path]
User Context: [Account]
Risk Level: [Critical/High/Medium]
ATT&CK Technique: [T1548.00x]

Other files in this skill

assets/template.md (verbatim)

T1548 Elevation Control Abuse Hunt Template

Hunt Metadata

Field Value
Hunt ID TH-UAC-YYYY-MM-DD-NNN
Analyst
Date
Status [ ] In Progress / [ ] Complete

Hypothesis

Adversaries are bypassing User Account Control or other elevation mechanisms to gain administrative privileges without triggering user consent prompts.

Registry Modification Findings

# Time Host Registry Key Value Set Modifying Process Severity
1

Auto-Elevate Process Abuse

# Time Host Auto-Elevate Binary Unexpected Parent Child Process Severity
1

Recommendations

  1. Remediate: [Revert registry modifications]
  2. Investigate: [Actions taken with elevated privileges]
  3. Harden: [Set UAC to Always Notify, deploy ASR rules]
  4. Monitor: [Registry keys and auto-elevate process chains]

references/api-reference.md (verbatim)

API Reference: T1548 Abuse Elevation Control Mechanism

MITRE ATT&CK T1548 Sub-Techniques

Sub-technique Name Platform
T1548.001 Setuid and Setgid Linux/macOS
T1548.002 Bypass User Account Control Windows
T1548.003 Sudo and Sudo Caching Linux/macOS
T1548.004 Elevated Execution with Prompt macOS

UAC Bypass — Auto-Elevate Binaries

Known Auto-Elevate Targets

Binary Bypass Method
fodhelper.exe Registry key hijack
computerdefaults.exe ms-settings handler
eventvwr.exe mscfile handler
sdclt.exe App paths hijack
wsreset.exe Bypasses defender
cmstp.exe INF file execution

Registry Keys for UAC Bypass

HKCU\Software\Classes\ms-settings\Shell\Open\command
HKCU\Software\Classes\mscfile\Shell\Open\command

Windows UAC Configuration

Check UAC Level

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
# EnableLUA = 1 (UAC enabled)
# ConsentPromptBehaviorAdmin = 0-5

ConsentPromptBehaviorAdmin Values

Value Behavior
0 Elevate without prompting
1 Prompt for credentials on secure desktop
2 Prompt for consent on secure desktop
5 Prompt for consent (default)

Linux Privilege Escalation

sudo Configuration Check

sudo -l                    # List allowed commands
cat /etc/sudoers           # Full sudoers file
visudo -c                  # Validate syntax

Find SUID Binaries

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null   # SGID

GTFOBins Sudo Escapes

Binary Escape
vim sudo vim -c ':!/bin/bash'
find sudo find . -exec /bin/bash \;
python sudo python -c 'import os; os.system("/bin/bash")'
nmap sudo nmap --interactive (old versions)

Sysmon Detection Rules

Event 13 — Registry Value Set

<RegistryEvent onmatch="include">
  <TargetObject condition="contains">ms-settings\Shell\Open\command</TargetObject>
  <TargetObject condition="contains">mscfile\Shell\Open\command</TargetObject>
</RegistryEvent>

Sigma Rule — UAC Bypass

title: UAC Bypass via Fodhelper
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'ms-settings\Shell\Open\command'
    condition: selection
level: critical

references/standards.md (verbatim)

Standards and References - T1548 Elevation Control Abuse

MITRE ATT&CK Sub-Techniques

Sub-Technique Platform Description
T1548.001 Linux/macOS Setuid and Setgid binary abuse
T1548.002 Windows Bypass User Account Control
T1548.003 Linux/macOS Sudo and Sudo Caching
T1548.004 macOS Elevated Execution with Prompt

Known UAC Bypass Methods (60+ documented)

Method Binary Registry Key Detection
fodhelper fodhelper.exe ms-settings\shell\open\command Registry + process creation
eventvwr eventvwr.exe mscfile\shell\open\command Registry + process creation
sdclt sdclt.exe exefile\shell\open\command Registry + process creation
computerdefaults computerdefaults.exe ms-settings\shell\open\command Registry + process creation
CMSTP cmstp.exe N/A (INF file) Process creation with /s /ni
slui slui.exe exefile\shell\open\command Registry + process creation
DiskCleanup cleanmgr.exe Environment variable hijack Environment + process
Registry Key Purpose
HKCU\Software\Classes\ms-settings\shell\open\command fodhelper/computerdefaults bypass
HKCU\Software\Classes\mscfile\shell\open\command eventvwr bypass
HKCU\Software\Classes\exefile\shell\open\command sdclt/slui bypass
HKCU\Software\Classes\Folder\shell\open\command Folder handler bypass
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UAC disable
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin UAC level

Detection Events

Source Event ID Description
Sysmon 1 Auto-elevate process creation
Sysmon 12 Registry key creation (UAC keys)
Sysmon 13 Registry value modification
Security 4688 Process creation with elevation
Security 4657 Registry value modification audit

references/workflows.md (verbatim)

Detailed Hunting Workflow - T1548 Elevation Control Abuse

Phase 1: Registry-Based UAC Bypass Detection

Step 1.1 - Monitor UAC Registry Keys

index=sysmon (EventCode=12 OR EventCode=13)
| where match(TargetObject, "(?i)(ms-settings|mscfile|exefile|Folder)\\\\shell\\\\open\\\\command")
| table _time Computer User Image TargetObject Details EventCode

Step 1.2 - Detect UAC Policy Changes

index=sysmon EventCode=13
| where match(TargetObject, "(?i)Policies\\\\System\\\\(EnableLUA|ConsentPromptBehaviorAdmin)")
| table _time Computer User Image TargetObject Details

Phase 2: Auto-Elevating Process Chain Detection

Step 2.1 - Suspicious Auto-Elevate Launches

index=sysmon EventCode=1
| where match(Image, "(?i)(fodhelper|computerdefaults|eventvwr|sdclt|slui)\.exe$")
| where NOT match(ParentImage, "(?i)(explorer\.exe|svchost\.exe)$")
| stats count by Image ParentImage Computer User

Step 2.2 - Children of Auto-Elevate Processes

index=sysmon EventCode=1
| where match(ParentImage, "(?i)(fodhelper|computerdefaults|eventvwr|sdclt|slui)\.exe$")
| where match(Image, "(?i)(cmd|powershell|wscript|cscript|mshta)\.exe$")
| table _time Computer Image CommandLine ParentImage User

Phase 3: Linux Elevation Abuse

Step 3.1 - Setuid Binary Hunting

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null

Step 3.2 - Sudo Abuse Detection

index=linux sourcetype=syslog
| where match(_raw, "(?i)sudo.*COMMAND=")
| where NOT match(_raw, "(?i)(apt-get|yum|systemctl|service)")
| table _time host user command

Phase 4: Response

  1. Revert malicious registry modifications
  2. Investigate what was executed with elevated privileges
  3. Set UAC to highest level (Always Notify)
  4. Deploy ASR rules against UAC bypasses
  5. Monitor for repeated escalation attempts

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.