Which SIEM platforms have a T1548 detection rule?

df00tech provides T1548 (Abuse Elevation Control Mechanism) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1548 detection?

The T1548 detection is rated high severity with high confidence.

What are common false positives for T1548?

Common false positives for T1548 include: Software installers that legitimately invoke auto-elevate binaries as part of their installation workflow (e.g., Windows installer packages that chain through fodhelper); Group Policy and SCCM/Intune deployments that spawn cmd.exe or PowerShell as children of management binaries during system configuration; IT administration tools (MMC snap-ins, Remote Server Administration Tools) that legitimately elevate to High integrity when launched by administrators via RunAs.

T1548

Abuse Elevation Control Mechanism

Q: What data sources are required to detect Abuse Elevation Control Mechanism (T1548)?

Detecting Abuse Elevation Control Mechanism requires the following data sources: Process: Process Creation, Process: OS API Execution, Windows Registry: Windows Registry Key Modification, Microsoft Defender for Endpoint, Linux: Audit Logs.

Privilege Escalation Defense Evasion Last updated: April 20, 2026

Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms intended to limit privileges a user can perform. Adversaries exploit these mechanisms across Windows (UAC bypass via auto-elevate binaries, COM object hijacking, DLL side-loading into elevated processes), Linux (setuid/setgid bit abuse, sudo misconfiguration, pkexec exploitation), macOS (TCC database manipulation, Elevated Execution with Prompt), and cloud environments (temporary role assumption, IAM privilege escalation). Real-world actors including UNC3886 and malware like Raspberry Robin have weaponized these techniques to gain SYSTEM or root access without triggering standard UAC consent dialogs.

What is T1548 Abuse Elevation Control Mechanism?

Abuse Elevation Control Mechanism (T1548) maps to the Privilege Escalation and Defense Evasion tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for Abuse Elevation Control Mechanism, covering the data sources and telemetry it touches: Process: Process Creation, Process: OS API Execution, Windows Registry: Windows Registry Key Modification, Microsoft Defender for Endpoint, Linux: Audit Logs. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Privilege Escalation Defense Evasion
Technique: T1548 Abuse Elevation Control Mechanism
Canonical reference: https://attack.mitre.org/techniques/T1548/

Microsoft Sentinel / Defender

kusto

let UACBypassAutoElevateBinaries = dynamic([
  "fodhelper.exe", "eventvwr.exe", "sdclt.exe", "cmstp.exe",
  "computerdefaults.exe", "slui.exe", "wsreset.exe", "dccw.exe",
  "pkgmgr.exe", "wusa.exe", "infdefaultinstall.exe", "msconfig.exe",
  "colorcpl.exe", "cliconfg.exe", "dism.exe", "eudcedit.exe",
  "iexpress.exe", "ntprint.exe", "recdisc.exe", "tabletpc.cpl"
]);
let SuspiciousChildProcesses = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe",
  "cscript.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe",
  "certutil.exe", "bitsadmin.exe", "wmic.exe", "regasm.exe", "regsvcs.exe"
]);
let LegitimateElevatedParents = dynamic([
  "services.exe", "svchost.exe", "lsass.exe", "csrss.exe", "wininit.exe",
  "winlogon.exe", "smss.exe", "taskhostw.exe", "userinit.exe", "msiexec.exe",
  "TiWorker.exe", "TrustedInstaller.exe", "WmiPrvSE.exe"
]);
// Detection 1: UAC Bypass - auto-elevate binary spawning suspicious child process
let UACBypassChildSpawn = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any (UACBypassAutoElevateBinaries)
| where FileName has_any (SuspiciousChildProcesses)
| extend DetectionType = "UAC_Bypass_AutoElevate_Child"
| extend RiskScore = 80
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ProcessIntegrityLevel, InitiatingProcessIntegrityLevel,
          DetectionType, RiskScore;
// Detection 2: Unexpected integrity level escalation (Medium/Low parent spawning High/System child)
let IntegrityEscalation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessIntegrityLevel in ("High", "System")
| where InitiatingProcessIntegrityLevel in ("Medium", "Low")
| where InitiatingProcessFileName !in~ (LegitimateElevatedParents)
| where FileName !in~ ("consent.exe", "dllhost.exe", "RuntimeBroker.exe")
| where AccountName !endswith "$"
| extend DetectionType = "Integrity_Level_Escalation"
| extend RiskScore = 70
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ProcessIntegrityLevel, InitiatingProcessIntegrityLevel,
          DetectionType, RiskScore;
// Detection 3: Linux setuid abuse and sudo privilege escalation
let LinuxPrivEsc = DeviceProcessEvents
| where Timestamp > ago(24h)
| where OSPlatform == "Linux"
| where ProcessCommandLine has_any (
    "chmod +s", "chmod u+s", "chmod 4755", "chmod 4777", "chmod 6755",
    "sudo -s", "sudo su", "sudo bash", "sudo sh", "sudo /bin/bash",
    "sudo /bin/sh", "sudo python", "sudo perl", "sudo ruby",
    "pkexec", "doas "
  )
| where AccountName !in ("root", "_apt", "daemon", "nobody")
| extend DetectionType = "Linux_Setuid_Sudo_Abuse"
| extend RiskScore = 65
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ProcessIntegrityLevel, InitiatingProcessIntegrityLevel,
          DetectionType, RiskScore;
// Detection 4: Fodhelper registry hijack preparation (writing to HKCU shell\open\command)
let FodhelperRegistryPrep = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has_all ("Software\\Classes", "ms-settings", "shell\\open\\command")
    or RegistryKey has_all ("Software\\Classes", "mscfile", "shell\\open\\command")
| extend DetectionType = "UAC_Bypass_Registry_Hijack_Prep"
| extend RiskScore = 90
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
          FileName = InitiatingProcessFileName,
          ProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          RegistryKey, RegistryValueName, RegistryValueData,
          DetectionType, RiskScore;
// Union all detection types
UACBypassChildSpawn
| union IntegrityEscalation
| union LinuxPrivEsc
| union (FodhelperRegistryPrep | extend ProcessIntegrityLevel = "", InitiatingProcessIntegrityLevel = "")
| sort by Timestamp desc

Detects T1548 Abuse Elevation Control Mechanism across four detection patterns using Microsoft Defender for Endpoint tables. Pattern 1 catches UAC bypass via auto-elevate binaries (fodhelper, eventvwr, sdclt, etc.) spawning suspicious child processes like cmd.exe or PowerShell. Pattern 2 detects unexpected integrity level escalation where a Medium/Low integrity parent spawns a High/System integrity child without going through consent.exe. Pattern 3 covers Linux setuid bit manipulation and sudo abuse. Pattern 4 catches the registry key staging step of registry-based UAC bypasses (HKCU ms-settings or mscfile shell\open\command hijacking used by fodhelper and eventvwr techniques).

high severity high confidence

Data Sources

Process: Process Creation Process: OS API Execution Windows Registry: Windows Registry Key Modification Microsoft Defender for Endpoint Linux: Audit Logs

Required Tables

DeviceProcessEvents DeviceRegistryEvents

False Positives

Software installers that legitimately invoke auto-elevate binaries as part of their installation workflow (e.g., Windows installer packages that chain through fodhelper)
Group Policy and SCCM/Intune deployments that spawn cmd.exe or PowerShell as children of management binaries during system configuration
IT administration tools (MMC snap-ins, Remote Server Administration Tools) that legitimately elevate to High integrity when launched by administrators via RunAs
Linux package managers (apt, yum, dnf) invoking sudo for legitimate system package installation and upgrade operations
Developer build systems using chmod to mark compiled executables or test binaries, and CI/CD pipelines running as non-root that sudo to install dependencies

Splunk

spl

(
  index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  | eval Image=lower(Image), ParentImage=lower(ParentImage)
  | eval CommandLine=coalesce(CommandLine, "")
  | eval ParentCommandLine=coalesce(ParentCommandLine, "")
)
OR
(
  index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688
  | eval Image=lower(NewProcessName), ParentImage=lower(ParentProcessName)
  | eval CommandLine=coalesce(CommandLine, ""), ParentCommandLine=""
)
| eval UACBypassParent=if(
    match(ParentImage, "(fodhelper|eventvwr|sdclt|cmstp|computerdefaults|slui|wsreset|dccw|pkgmgr|wusa|infdefaultinstall|msconfig|colorcpl|cliconfg|dism|eudcedit|iexpress|ntprint|recdisc)\\.exe"),
    1, 0
  )
| eval SuspiciousChild=if(
    match(Image, "(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|bitsadmin|wmic|regasm|regsvcs)\\.exe"),
    1, 0
  )
| eval FodhelperBypass=if(
    match(ParentImage, "fodhelper\\.exe") AND match(Image, "(cmd|powershell|pwsh|mshta)\\.exe"),
    1, 0
  )
| eval EventvwrBypass=if(
    match(ParentImage, "eventvwr\\.exe") AND match(Image, "(cmd|powershell|pwsh|mshta|wscript)\\.exe"),
    1, 0
  )
| eval SdcltBypass=if(
    match(ParentImage, "sdclt\\.exe") AND match(Image, "(cmd|powershell|pwsh)\\.exe"),
    1, 0
  )
| eval CmstpBypass=if(
    match(ParentImage, "cmstp\\.exe") AND match(Image, "(cmd|powershell|mshta|rundll32)\\.exe"),
    1, 0
  )
| eval GenericAutoElevate=if(UACBypassParent=1 AND SuspiciousChild=1, 1, 0)
| eval SuspicionScore=FodhelperBypass + EventvwrBypass + SdcltBypass + CmstpBypass + GenericAutoElevate
| where SuspicionScore > 0
| eval DetectionType=case(
    FodhelperBypass=1, "Fodhelper_UAC_Bypass",
    EventvwrBypass=1, "Eventvwr_UAC_Bypass",
    SdcltBypass=1, "Sdclt_UAC_Bypass",
    CmstpBypass=1, "Cmstp_UAC_Bypass",
    GenericAutoElevate=1, "Generic_AutoElevate_UAC_Bypass",
    true(), "Unknown"
  )
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionType, SuspicionScore
| sort - SuspicionScore, - _time

Detects T1548 UAC bypass patterns using Sysmon Event ID 1 (Process Creation) and Security Event ID 4688, combining both sources for broader coverage. Evaluates parent-child process relationships against known auto-elevate UAC bypass binaries including fodhelper, eventvwr, sdclt, cmstp, and computerdefaults. Assigns specific detection labels for each bypass variant and a cumulative suspicion score. The query normalizes Image and ParentImage to lowercase for case-insensitive matching across both Sysmon and Security event formats.

high severity high confidence

Data Sources

Process: Process Creation Sysmon Event ID 1 Windows Security Event ID 4688

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

Software installers that legitimately invoke auto-elevate binaries as part of their installation workflow, particularly third-party installers that chain through Windows trusted binaries
SCCM/Intune application deployments that spawn cmd.exe or PowerShell as child processes of management binaries during provisioning tasks
IT administration scripts that use RunAs or scheduled tasks to elevate through known binaries, especially in environments without enforced UAC policies
Legitimate Windows administrative tools (Event Viewer launched by administrators, Disk Cleanup invoked by maintenance scripts) that may trigger eventvwr or cleanmgr parent associations
Software packaging tools and virtualization platforms (App-V, ThinApp) that wrap installers inside auto-elevated process containers

Elastic Security (EQL)

eql

any where
(
  /* UAC Bypass: auto-elevate binary spawning suspicious child process */
  event.category == "process" and event.type == "start" and
  process.parent.name : (
    "fodhelper.exe", "eventvwr.exe", "sdclt.exe", "cmstp.exe",
    "computerdefaults.exe", "slui.exe", "wsreset.exe", "dccw.exe",
    "pkgmgr.exe", "wusa.exe", "infdefaultinstall.exe", "msconfig.exe",
    "colorcpl.exe", "cliconfg.exe", "dism.exe", "eudcedit.exe",
    "iexpress.exe", "ntprint.exe", "recdisc.exe"
  ) and
  process.name : (
    "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe",
    "cscript.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe",
    "certutil.exe", "bitsadmin.exe", "wmic.exe", "regasm.exe", "regsvcs.exe"
  )
)
or
(
  /* Fodhelper/EventVwr registry hijack: writing to ms-settings or mscfile shell open command */
  event.category == "registry" and
  event.type in ("creation", "change") and
  (
    registry.path : "*\\Software\\Classes\\ms-settings\\shell\\open\\command*" or
    registry.path : "*\\Software\\Classes\\mscfile\\shell\\open\\command*"
  )
)
or
(
  /* Linux setuid abuse and sudo privilege escalation */
  event.category == "process" and event.type == "start" and
  host.os.type == "linux" and
  (
    process.command_line : ("*chmod +s*", "*chmod u+s*", "*chmod 4755*", "*chmod 4777*", "*chmod 6755*") or
    (
      process.name == "sudo" and
      process.args : ("-s", "su", "bash", "sh", "/bin/bash", "/bin/sh", "python*", "perl*", "ruby*")
    ) or
    process.name in ("pkexec", "doas")
  ) and
  not user.name in ("root", "_apt", "daemon", "nobody")
)

Detects abuse of elevation control mechanisms (T1548) across three behavioral patterns: (1) UAC bypass via auto-elevate Windows binaries spawning suspicious child processes such as cmd.exe or PowerShell, (2) registry key creation under ms-settings or mscfile shell\open\command paths used in fodhelper and eventvwr UAC hijacks, and (3) Linux privilege escalation via setuid bit manipulation or interactive sudo shell spawning by non-privileged accounts. Uses ECS fields from Elastic Endpoint or Winlogbeat/Auditbeat data streams.

high severity high confidence

Data Sources

Elastic Endpoint (process and registry events) Winlogbeat with Sysmon Auditbeat (Linux process events)

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.registry-* winlogbeat-* auditbeat-*

False Positives

IT administrators running PowerShell or CMD from management UIs (e.g., DISM-based imaging workflows) that legitimately inherit auto-elevate binary parent process chains
Software deployment tools such as SCCM, PDQ Deploy, or Microsoft Intune that invoke fodhelper.exe or wusa.exe as part of sanctioned patch workflows and subsequently spawn shell processes
Linux system administrators running 'sudo bash' or 'sudo -s' interactively for authorized maintenance tasks on managed servers; tune by excluding known admin accounts or source hosts

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  "Process Name" AS child_process,
  "Parent Process Name" AS parent_process,
  "Command Line" AS command_line,
  "Parent Command Line" AS parent_command_line,
  CASE
    WHEN LOWER("Parent Process Name") = 'fodhelper.exe'
      AND LOWER("Process Name") MATCHES '(cmd|powershell|pwsh|mshta)\.exe'
      THEN 'Fodhelper_UAC_Bypass'
    WHEN LOWER("Parent Process Name") = 'eventvwr.exe'
      AND LOWER("Process Name") MATCHES '(cmd|powershell|pwsh|mshta|wscript)\.exe'
      THEN 'Eventvwr_UAC_Bypass'
    WHEN LOWER("Parent Process Name") = 'sdclt.exe'
      AND LOWER("Process Name") MATCHES '(cmd|powershell|pwsh)\.exe'
      THEN 'Sdclt_UAC_Bypass'
    WHEN LOWER("Parent Process Name") = 'cmstp.exe'
      AND LOWER("Process Name") MATCHES '(cmd|powershell|mshta|rundll32)\.exe'
      THEN 'Cmstp_UAC_Bypass'
    WHEN LOWER("Parent Process Name") MATCHES '(computerdefaults|slui|wsreset|dccw|pkgmgr|wusa|infdefaultinstall|msconfig|colorcpl|cliconfg|dism|eudcedit|iexpress|ntprint|recdisc)\.exe'
      AND LOWER("Process Name") MATCHES '(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|bitsadmin|wmic|regasm|regsvcs)\.exe'
      THEN 'Generic_AutoElevate_UAC_Bypass'
    WHEN "Registry Key" IMATCHES '%Software\\Classes\\ms-settings\\shell\\open\\command%'
      OR "Registry Key" IMATCHES '%Software\\Classes\\mscfile\\shell\\open\\command%'
      THEN 'UAC_Bypass_Registry_Hijack_Prep'
    WHEN LOWER("Command Line") MATCHES '.*(chmod \+s|chmod u\+s|chmod 4755|chmod 4777|chmod 6755|sudo -s|sudo su|sudo bash|sudo sh|sudo /bin/bash|sudo /bin/sh|pkexec|doas ).*'
      AND username NOT IN ('root', '_apt', 'daemon', 'nobody')
      THEN 'Linux_Setuid_Sudo_Abuse'
    ELSE 'Unknown'
  END AS detection_type,
  CASE
    WHEN LOWER("Registry Key") IMATCHES '%ms-settings\\shell\\open\\command%' THEN 90
    WHEN LOWER("Parent Process Name") = 'fodhelper.exe' THEN 85
    WHEN LOWER("Parent Process Name") IN ('eventvwr.exe','sdclt.exe','cmstp.exe') THEN 80
    ELSE 65
  END AS risk_score
FROM events
WHERE
  starttime > (CURRENT_TIMESTAMP - 86400000)
  AND (
    (
      LOWER("Parent Process Name") MATCHES
        '(fodhelper|eventvwr|sdclt|cmstp|computerdefaults|slui|wsreset|dccw|pkgmgr|wusa|infdefaultinstall|msconfig|colorcpl|cliconfg|dism|eudcedit|iexpress|ntprint|recdisc)\.exe'
      AND LOWER("Process Name") MATCHES
        '(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|bitsadmin|wmic|regasm|regsvcs)\.exe'
    )
    OR (
      "Registry Key" IMATCHES '%Software\\Classes\\ms-settings\\shell\\open\\command%'
      OR "Registry Key" IMATCHES '%Software\\Classes\\mscfile\\shell\\open\\command%'
    )
    OR (
      LOWER("Command Line") MATCHES
        '.*(chmod \+s|chmod u\+s|chmod 4755|chmod 4777|chmod 6755|sudo -s|sudo su|sudo bash|sudo sh|sudo /bin/bash|pkexec|doas ).*'
      AND username NOT IN ('root', '_apt', 'daemon', 'nobody')
    )
  )
ORDER BY starttime DESC

Detects UAC bypass via auto-elevate binaries spawning suspicious child processes, registry hijack preparation targeting ms-settings and mscfile shell open command paths, and Linux setuid/sudo privilege escalation. Uses AQL MATCHES operator for regex-based process name correlation across Windows Security, Sysmon, and Linux log sources ingested into QRadar. Risk scoring is weighted by specificity: registry hijack prep scores highest at 90 as it indicates deliberate bypass preparation.

high severity high confidence

Data Sources

Windows Security Event Log (EventID 4688) Sysmon via Windows Event Log (EventID 1, 12, 13) Linux auditd / syslog process events

Required Tables

events

False Positives

Enterprise patch management solutions that invoke wusa.exe or pkgmgr.exe as part of update pipelines and subsequently spawn child cmd.exe or msiexec.exe processes for installation tasks
Security assessment or vulnerability scanning tools that enumerate sudo configurations on Linux endpoints, triggering sudo command pattern matches without actual privilege escalation
Developer workstations where fodhelper or eventvwr may be legitimately launched alongside developer shells in non-adversarial contexts; scope the rule to server OU or production asset groups to reduce noise

Sumo Logic CSE

sql

(_sourceCategory=*windows/sysmon* OR _sourceCategory=*windows/security* OR _sourceCategory=*linux/secure* OR _sourceCategory=*linux/audit*)
| parse regex field=_raw "(?:Image|NewProcessName)[=:\s]+(?:'|")?(?P<child_image>[^'"\s\r\n]+)" nodrop
| parse regex field=_raw "(?:ParentImage|ParentProcessName)[=:\s]+(?:'|")?(?P<parent_image>[^'"\s\r\n]+)" nodrop
| parse regex field=_raw "(?:CommandLine|ProcessCommandLine)[=:\s]+(?:'|")?(?P<command_line>[^\r\n]+)" nodrop
| parse regex field=_raw "(?:User|SubjectUserName|AccountName)[=:\s]+(?:'|")?(?P<username>[^'"\s\r\n]+)" nodrop
| parse regex field=_raw "(?:Computer|Workstation|hostname)[=:\s]+(?:'|")?(?P<hostname>[^'"\s\r\n]+)" nodrop
| parse regex field=_raw "(?:RegistryKey|TargetObject)[=:\s]+(?:'|")?(?P<registry_key>[^'"\s\r\n]+)" nodrop
| parse regex field=_raw "EventID[=:\s]+(?P<event_id>\d+)" nodrop
| where (
    /* UAC Bypass: auto-elevate binary spawning suspicious child */
    (
      parent_image matches /(?i)(fodhelper|eventvwr|sdclt|cmstp|computerdefaults|slui|wsreset|dccw|pkgmgr|wusa|infdefaultinstall|msconfig|colorcpl|cliconfg|dism|eudcedit|iexpress|ntprint|recdisc)\.exe/
      and child_image matches /(?i)(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|bitsadmin|wmic|regasm|regsvcs)\.exe/
    )
    /* Registry hijack preparation */
    or (
      registry_key matches /(?i).*Software\\Classes\\(ms-settings|mscfile)\\shell\\open\\command.*/
      and event_id in ("12", "13", "4657")
    )
    /* Linux setuid/sudo abuse */
    or (
      command_line matches /(?i).*(chmod \+s|chmod u\+s|chmod 4755|chmod 4777|chmod 6755|sudo -s|sudo su|sudo bash|sudo sh|sudo \/bin\/(bash|sh)|pkexec|doas ).*/
      and not username in ("root", "_apt", "daemon", "nobody", "www-data")
    )
  )
| if (parent_image matches /(?i)fodhelper\.exe/ and child_image matches /(?i)(cmd|powershell|pwsh|mshta)\.exe/, "Fodhelper_UAC_Bypass",
    if (parent_image matches /(?i)eventvwr\.exe/ and child_image matches /(?i)(cmd|powershell|pwsh|mshta|wscript)\.exe/, "Eventvwr_UAC_Bypass",
      if (parent_image matches /(?i)sdclt\.exe/ and child_image matches /(?i)(cmd|powershell|pwsh)\.exe/, "Sdclt_UAC_Bypass",
        if (parent_image matches /(?i)cmstp\.exe/ and child_image matches /(?i)(cmd|powershell|mshta|rundll32)\.exe/, "Cmstp_UAC_Bypass",
          if (registry_key matches /(?i).*ms-settings.*shell.*open.*command.*/, "UAC_Bypass_Registry_Hijack_Prep",
            if (command_line matches /(?i).*(chmod \+s|chmod 4[67]|sudo (bash|sh|-s)|pkexec).*/, "Linux_Setuid_Sudo_Abuse",
              "Generic_AutoElevate_UAC_Bypass"
            )
          )
        )
      )
    )
  ) as detection_type
| if (detection_type = "UAC_Bypass_Registry_Hijack_Prep", 90,
    if (detection_type = "Fodhelper_UAC_Bypass", 85,
      if (detection_type in ("Eventvwr_UAC_Bypass", "Sdclt_UAC_Bypass", "Cmstp_UAC_Bypass"), 80,
        65
      )
    )
  ) as risk_score
| fields _messagetime, hostname, username, child_image, parent_image, command_line, registry_key, detection_type, risk_score
| sort by _messagetime desc

Detects abuse of elevation control mechanisms (T1548) across three behavioral patterns using regex parsing of raw Windows Sysmon, Windows Security, and Linux audit logs. Detection logic covers: UAC bypass via named auto-elevate binaries (fodhelper, eventvwr, sdclt, cmstp, and 15 others) spawning shell or scripting children; registry key writes to ms-settings or mscfile shell open command paths indicative of hijack setup; and Linux setuid chmod or interactive sudo shell invocations by non-privileged accounts. Risk scoring is applied per detection sub-type.

high severity high confidence

Data Sources

Windows Sysmon (EventID 1 process create, EventID 12/13 registry) Windows Security Event Log (EventID 4688 process create, EventID 4657 registry) Linux auditd / secure log (process exec events)

Required Tables

_sourceCategory=*windows/sysmon* _sourceCategory=*windows/security* _sourceCategory=*linux/secure* _sourceCategory=*linux/audit*

False Positives

Legitimate administrative scripts that invoke colorcpl.exe, dism.exe, or wusa.exe as part of Windows image servicing pipelines and subsequently spawn cmd.exe for follow-on configuration steps
Penetration testing or red team exercises on authorized hosts where UAC bypass techniques are being validated using tools like UACME, Metasploit, or PowerShell Empire with proper change tickets
Linux DevOps engineers using 'sudo bash' or 'sudo -s' during interactive debugging sessions on build servers; consider allowlisting specific usernames or source IP ranges used by ops teams

Google Chronicle / SecOps

yaral

rule uac_bypass_autoelevate_child_spawn {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects UAC bypass via auto-elevate binaries spawning suspicious shell or scripting child processes (T1548.002)"
    mitre_attack_tactic = "Privilege Escalation"
    mitre_attack_technique = "T1548"
    mitre_attack_subtechnique = "T1548.002"
    severity = "HIGH"
    priority = "HIGH"
    confidence = "HIGH"
    version = "1.0"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(fodhelper|eventvwr|sdclt|cmstp|computerdefaults|slui|wsreset|dccw|pkgmgr|wusa|infdefaultinstall|msconfig|colorcpl|cliconfg|dism|eudcedit|iexpress|ntprint|recdisc)\.exe$/
    $proc.target.process.file.full_path = /(?i)(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|bitsadmin|wmic|regasm|regsvcs)\.exe$/
    $proc.principal.hostname = $hostname

  condition:
    $proc
}

rule uac_bypass_registry_hijack_prep {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects registry key writes to ms-settings or mscfile shell open command paths used in fodhelper/eventvwr UAC bypass (T1548.002)"
    mitre_attack_tactic = "Privilege Escalation"
    mitre_attack_technique = "T1548"
    mitre_attack_subtechnique = "T1548.002"
    severity = "CRITICAL"
    priority = "HIGH"
    confidence = "HIGH"
    version = "1.0"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    (
      $reg.target.registry.registry_key = /(?i).*\\Software\\Classes\\ms-settings\\shell\\open\\command.*/ or
      $reg.target.registry.registry_key = /(?i).*\\Software\\Classes\\mscfile\\shell\\open\\command.*/
    )
    $reg.principal.hostname = $hostname

  condition:
    $reg
}

rule linux_setuid_sudo_privilege_escalation {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Linux privilege escalation via setuid bit manipulation or interactive sudo shell spawning by non-privileged accounts (T1548.001 / T1548.003)"
    mitre_attack_tactic = "Privilege Escalation"
    mitre_attack_technique = "T1548"
    mitre_attack_subtechnique = "T1548.001"
    severity = "HIGH"
    priority = "MEDIUM"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $linux.metadata.event_type = "PROCESS_LAUNCH"
    $linux.principal.platform = "LINUX"
    (
      $linux.target.process.command_line = /(?i).*(chmod \+s|chmod u\+s|chmod 4755|chmod 4777|chmod 6755).*/  or
      (
        $linux.target.process.file.full_path = /(?i).*\/sudo$/ and
        $linux.target.process.command_line = /(?i)sudo\s+(-s|su|bash|sh|\/bin\/(bash|sh)|python[23]?|perl|ruby).*/
      ) or
      $linux.target.process.file.full_path = /(?i).*\/(pkexec|doas)$/
    )
    not $linux.principal.user.userid = "root"
    not $linux.principal.user.userid = "daemon"
    not $linux.principal.user.userid = "nobody"
    $linux.principal.hostname = $hostname

  condition:
    $linux
}

Three complementary Chronicle YARA-L 2.0 rules detecting abuse of elevation control mechanisms (T1548): Rule 1 matches PROCESS_LAUNCH events where a known UAC auto-elevate binary (18 binaries including fodhelper, eventvwr, sdclt, cmstp) spawns a shell or scripting interpreter child process. Rule 2 matches REGISTRY_MODIFICATION events targeting ms-settings or mscfile shell open command paths used in registry-based UAC hijacks. Rule 3 detects Linux setuid bit manipulation and interactive sudo shell invocations by non-system accounts. All rules use UDM field model with principal (parent/actor) and target (child/object) semantics.

high severity high confidence

Data Sources

Google Chronicle UDM (PROCESS_LAUNCH events from Windows endpoint agents) Google Chronicle UDM (REGISTRY_MODIFICATION events from Windows endpoint agents) Google Chronicle UDM (PROCESS_LAUNCH events from Linux endpoint agents)

Required Tables

UDM events (PROCESS_LAUNCH) UDM events (REGISTRY_MODIFICATION)

False Positives

Authorized IT management tooling that invokes colorcpl.exe, recdisc.exe, or msconfig.exe as part of OS hardening scripts and spawns cmd.exe for configuration validation steps
Enterprise software packaging tools (WiX, NSIS, InstallShield) that use dism.exe or wusa.exe as parent processes for package extraction, potentially spawning msiexec.exe as a child
Linux system accounts performing authorized chmod operations on application binaries during deployment pipelines; tune the Linux rule by adding allowlist conditions for known CI/CD service account UIDs

CrowdStrike LogScale (CQL)

cql

// Detection 1: UAC Bypass - auto-elevate binary spawning suspicious child process
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)(fodhelper|eventvwr|sdclt|cmstp|computerdefaults|slui|wsreset|dccw|pkgmgr|wusa|infdefaultinstall|msconfig|colorcpl|cliconfg|dism|eudcedit|iexpress|ntprint|recdisc)\.exe/i
| ImageFileName = /(?i)(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|bitsadmin|wmic|regasm|regsvcs)\.exe/i
| detection_type := case {
    ParentBaseFileName = /fodhelper\.exe/i and ImageFileName = /(?i)(cmd|powershell|pwsh|mshta)\.exe/ => "Fodhelper_UAC_Bypass";
    ParentBaseFileName = /eventvwr\.exe/i and ImageFileName = /(?i)(cmd|powershell|pwsh|mshta|wscript)\.exe/ => "Eventvwr_UAC_Bypass";
    ParentBaseFileName = /sdclt\.exe/i and ImageFileName = /(?i)(cmd|powershell|pwsh)\.exe/ => "Sdclt_UAC_Bypass";
    ParentBaseFileName = /cmstp\.exe/i and ImageFileName = /(?i)(cmd|powershell|mshta|rundll32)\.exe/ => "Cmstp_UAC_Bypass";
    * => "Generic_AutoElevate_UAC_Bypass"
  }
| risk_score := case {
    detection_type = "Fodhelper_UAC_Bypass" => 85;
    detection_type in ["Eventvwr_UAC_Bypass", "Sdclt_UAC_Bypass", "Cmstp_UAC_Bypass"] => 80;
    * => 65
  }
| table([_timeparsed, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, detection_type, risk_score])
| sort(field=_timeparsed, order=desc)

// Detection 2: Fodhelper registry hijack preparation (separate query - run independently)
// #event_simpleName=RegGenericValueSet OR #event_simpleName=RegSetValue
// | RegObjectName = /(?i).*\\Software\\Classes\\(ms-settings|mscfile)\\shell\\open\\command.*/i
// | table([_timeparsed, ComputerName, UserName, RegObjectName, RegStringValue, ImageFileName, CommandLine])
// | sort(field=_timeparsed, order=desc)

// Detection 3: Linux setuid/sudo abuse (separate query - run independently on Linux sensors)
// #event_simpleName=ProcessRollup2 event_platform=Lin
// | CommandLine = /(?i)(chmod \+s|chmod u\+s|chmod 4755|chmod 4777|chmod 6755|sudo -s|sudo su|sudo bash|sudo sh|sudo \/bin\/(bash|sh)|pkexec|doas )/i
// | UserName != "root"
// | table([_timeparsed, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])
// | sort(field=_timeparsed, order=desc)

Detects UAC bypass via auto-elevate Windows binaries spawning suspicious child processes using CrowdStrike Falcon ProcessRollup2 events. Primary query correlates ParentBaseFileName (auto-elevate binary list of 18 executables) with ImageFileName (shell and scripting interpreters), categorizing specific bypasses by technique (Fodhelper, Eventvwr, Sdclt, Cmstp) with risk scoring. Companion commented queries cover registry hijack preparation via RegGenericValueSet/RegSetValue events targeting ms-settings or mscfile shell open command keys, and Linux setuid/sudo abuse via Linux sensor ProcessRollup2 events. Uses Falcon's ParentBaseFileName field which contains only the filename without path, enabling reliable matching regardless of process path.

high severity high confidence

Data Sources

CrowdStrike Falcon Endpoint (ProcessRollup2 - process telemetry) CrowdStrike Falcon Endpoint (RegGenericValueSet / RegSetValue - registry telemetry) CrowdStrike Falcon Linux Sensor (ProcessRollup2 - Linux process telemetry)

Required Tables

ProcessRollup2 RegGenericValueSet RegSetValue

False Positives

Software update orchestration platforms that use wsreset.exe or wusa.exe as parent processes for update package execution, with msiexec.exe or cmd.exe spawned as legitimate installation children
Security tooling such as EDR agents or AV products that may spawn cmd.exe or powershell.exe from elevated management processes that share the auto-elevate binary naming space
Linux administrators using 'sudo bash' or 'sudo -s' for interactive escalation on systems where sudo is the standard privilege management mechanism; scope detection to servers or specific asset groups rather than all endpoints

Sigma rule & cross-platform mapping

The detection logic for Abuse Elevation Control Mechanism (T1548) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1548 Sigma rules on detection.fyi

Platform-specific guides for T1548

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-20 Research depth: deep

References (11)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Fodhelper UAC Bypass — Registry Staging and Execution
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject containing HKCU\Software\Classes\ms-settings\shell\open\command, Details showing cmd.exe payload. Sysmon Event ID 1 (Process Create): Image=fodhelper.exe with MandatoryLabel=High Mandatory Level. Sysmon Event ID 1 again: ParentImage=fodhelper.exe, Image=cmd.exe, MandatoryLabel=High Mandatory Level — this is the UAC bypassed child. Security Event ID 4624 may show a new elevated token. MDE DeviceRegistryEvents will show ActionType=RegistryValueSet on the ms-settings key.
Test 2Eventvwr UAC Bypass — mscfile COM Hijacking
Expected signal: Sysmon Event ID 13: TargetObject=HKCU\Software\Classes\mscfile\shell\open\command, Details=cmd.exe /c whoami /priv... Sysmon Event ID 1: Image=eventvwr.exe with MandatoryLabel=High Mandatory Level. Sysmon Event ID 1: ParentImage=eventvwr.exe, Image=cmd.exe, CommandLine containing whoami /priv, MandatoryLabel=High Mandatory Level. Security Event ID 4688 (if command line auditing enabled) with mandatory label showing High Integrity.
Test 3Linux Setuid Bit Abuse — Copy Shell and Set SUID
Expected signal: MDE DeviceProcessEvents (Linux): ProcessCommandLine containing 'chmod u+s /tmp/argus-suid-test'. Follow-on process event showing /tmp/argus-suid-test -p -c 'id; whoami' with AccountName of the test runner but effective UID of root in output. Linux audit log (auditd): SYSCALL records for chmod with mode=104755 (setuid+755), PATH record for the target file. /var/log/auth.log: sudo session opened for command /bin/chmod. Sysmon for Linux (if deployed): Event ID 1 showing chmod command, Event ID 1 showing suid binary execution.
Test 4Sudo GTFOBins Privilege Escalation — Python Breakout
Expected signal: Linux auth.log: sudo session opened for user root by testuser(uid=1000), COMMAND=/usr/bin/python3 -c import os... MDE DeviceProcessEvents (Linux): ProcessCommandLine='sudo python3 -c import os; os.setuid(0); os.system(id && whoami && cat /etc/shadow...' with AccountName=testuser. Auditd: SYSCALL setuid with uid=0 result=success from python3 process. The os.system('cat /etc/shadow') represents credential access following privilege escalation.
Test 5sdclt UAC Bypass — Folder Shell Command Hijacking
Expected signal: Sysmon Event ID 13: TargetObject=HKCU\Software\Classes\Folder\shell\open\command, Details=cmd.exe /c whoami /groups... Sysmon Event ID 1: Image=sdclt.exe with ProcessCommandLine containing /kickoffelev. Sysmon Event ID 1: ParentImage=sdclt.exe, Image=cmd.exe, MandatoryLabel=High Mandatory Level. MDE DeviceRegistryEvents: ActionType=RegistryValueSet on the Folder\shell\open\command key. If UAC bypass succeeds, whoami /groups output will show 'Mandatory Label\High Mandatory Level Label'.

Response Playbook

Triage

Identify the specific UAC bypass variant: check the parent process name against the known auto-elevate binary list (fodhelper, eventvwr, sdclt, cmstp, computerdefaults). Each variant has a distinct mechanism — fodhelper/computerdefaults use HKCU registry hijacking, eventvwr uses mscfile COM hijacking, cmstp uses INF file with RunPreSetupCommands.
Check the registry for staging artifacts: query HKCU\Software\Classes\ms-settings\shell\open\command, HKCU\Software\Classes\mscfile\shell\open\command, and HKCU\Software\Classes\Folder\shell\open\command for any values set recently. Their presence without legitimate software explains the bypass mechanism.
Evaluate the child process command line: what did the elevated process do? Look for download cradles, lateral movement tools, credential dumping (procdump lsass, comsvcs.dll MiniDump), or persistence mechanisms (reg.exe adding Run keys, schtasks.exe).
Correlate with the user account: is this a standard user, IT admin, or service account? Standard users triggering high-integrity processes through unexpected parents is highly anomalous. Admin accounts doing so may still indicate automation of privilege escalation to avoid consent prompts.
Check the integrity level chain in MDE: confirm ProcessIntegrityLevel is High or System while InitiatingProcessIntegrityLevel was Medium. If both are already High, the bypass may have occurred earlier — search for the staging registry writes 5-30 minutes prior.
For Linux alerts: examine /var/log/auth.log or /var/log/secure for corresponding sudo PAM events, check /etc/sudoers and /etc/sudoers.d/ for misconfigurations, and run 'find / -perm -4000 -type f' output from MDE process events to identify newly setuid-enabled binaries.

Containment

If the elevated process spawned network connections or written files: immediately isolate the endpoint using MDE Live Response or network isolation to prevent C2 communication or lateral movement from the elevated session.
If registry hijacking keys are confirmed (HKCU ms-settings or mscfile shell\open\command): delete the malicious registry values using reg delete or MDE Live Response before the bypass binary can be re-triggered. Key: HKCU\Software\Classes\ms-settings\shell\open\command.
If a service or scheduled task was created by the elevated process: query 'sc query' and 'schtasks /query' output, then delete any unauthorized entries created within the attack timeframe before the next execution.
If the elevated process performed credential access (LSASS access, registry SAM/SECURITY dump): immediately force password resets for all accounts on the affected endpoint and any accounts whose credentials may have been exposed — including service accounts.
For Linux setuid abuse: remove the setuid bit from any unauthorized binaries with 'chmod u-s <binary>', then audit /etc/sudoers and sudoers.d/ for NOPASSWD entries added by the attacker.
Block the initiating user account if compromise is confirmed: disable in Active Directory, revoke Azure AD tokens, and force sign-out of active sessions across all devices.

Evidence Collection

Registry: Export HKCU\Software\Classes\ms-settings, mscfile, Folder, and Shell subkeys — these contain UAC bypass staging payloads. Use reg export or MDE Live Response 'getfile' on the hive.
Process tree: collect the full parent-child process chain via MDE AdvancedHunting or Sysmon Event ID 1 for the 60 minutes before and after the bypass event. The staging process (writing registry keys) may appear 1-10 minutes before the auto-elevate binary execution.
File system artifacts: collect any files written by the elevated child process. Use Sysmon Event ID 11 or MDE DeviceFileEvents filtered by the elevated process's PID within 30 minutes of the detection.
Prefetch: C:\Windows\Prefetch\FODHELPER.EXE-*.pf, EVENTVWR.EXE-*.pf, SDCLT.EXE-*.pf — timestamps indicate when each auto-elevate binary was last invoked and what DLLs were loaded.
Windows Event Log: Security Event ID 4672 (Special Logon — SeDebugPrivilege and other sensitive privileges assigned) generated when the elevated process starts, correlates with the bypass timestamp.
Windows Event Log: Security Event ID 4688 with mandatory label = High Integrity or System, process command line showing the spawned payload.
MDE DeviceRegistryEvents: filter ActionType=RegistryValueSet on HKCU\Software\Classes paths for 1 hour before the bypass event to capture the staging write.
Memory image of the elevated process if it is still running: capture via procdump (from an admin context) or MDE Live Response 'collectInvestigationPackage' for full forensic package.

Escalation Criteria

! Elevated child process immediately spawned a network connection to an external IP or downloaded a secondary payload — indicates a complete exploitation chain reaching C2.
! Credential access followed the privilege escalation: LSASS process access (Sysmon Event ID 10 with GrantedAccess 0x1010 or higher), registry SAM/SECURITY hive read, or secretsdump-style tool execution from the elevated context.
! Lateral movement artifacts observed: net use to remote shares, PsExec execution, WMI remote process creation, or RDP logon from the compromised host within 30 minutes of the UAC bypass.
! Persistence mechanisms installed under the elevated context: new service creation (Event ID 7045), scheduled task with SYSTEM authority, registry Run key under HKLM (requires High integrity), or startup folder entry in all-users profile.
! Multiple hosts exhibiting the same UAC bypass pattern within a short time window — indicates automated propagation via worm behavior or domain-wide deployment by a threat actor.
! The bypassed account is a domain administrator, service account with broad permissions, or an account with access to sensitive systems (domain controllers, certificate authorities, backup servers).

Investigation Guide

Forensic Artifacts

> Registry: HKCU\Software\Classes\ms-settings\shell\open\command — fodhelper/computerdefaults UAC bypass payload location; will contain DelegateExecute (empty value) and Default (command to execute)
> Registry: HKCU\Software\Classes\mscfile\shell\open\command — eventvwr UAC bypass payload location; stores the command to run with elevated privileges
> Registry: HKCU\Software\Classes\Folder\shell\open\command — sdclt UAC bypass payload; check Default value and DelegateExecute
> File System: C:\Windows\Prefetch\FODHELPER.EXE-*.pf, EVENTVWR.EXE-*.pf, SDCLT.EXE-*.pf, CMSTP.EXE-*.pf — execution timestamps and loaded modules
> File System: C:\Windows\Temp\ and %APPDATA%\ — common drop locations for payloads staged before UAC bypass execution
> Event Log: Microsoft-Windows-UAC-FileVirtualization/Operational — records virtualized registry/file access that may indicate UAC bypass attempts
> Event Log: Security Event ID 4672 — Special Logon with elevated privileges assigned at process start
> Event Log: Security Event ID 4624 with LogonType=2 or 5, elevated token — correlates legitimate vs. bypassed elevation
> Sysmon Event ID 12/13 — Registry create/set events for HKCU\Software\Classes paths during bypass staging window
> Linux: /var/log/auth.log or /var/log/secure — PAM sudo authentication records with timestamps, command, and return code
> Linux: /etc/sudoers and /etc/sudoers.d/* — check for NOPASSWD entries, wildcard command allowances, or ALL=(ALL) grants added by attacker
> Linux: Output of 'find / -perm -4000 -type f 2>/dev/null' at time of incident — any setuid binary outside of /bin, /usr/bin, /usr/sbin is suspicious
> macOS: /Library/Application Support/com.apple.TCC/TCC.db — TCC database for T1548.006 sub-technique; check for unauthorized app entries

Tuning Guidance

The primary source of false positives for UAC bypass detections is legitimate software that spawns shells or administrative tools via auto-elevate binaries. Build an allowlist by first baselining all parent-child pairs involving auto-elevate binaries over 30 days in a non-alert mode — most legitimate software will show consistent, versioned command lines. Focus allowlisting on specific InitiatingProcessCommandLine + FileName combinations (e.g., msiexec.exe parent with cmd.exe child running specific installer scripts) rather than blanket exclusions by parent process. For integrity level escalation, exclude known software deployment systems (SCCM, Intune, Altiris agent processes) by their process file hash rather than just name. The registry-based detection (HKCU\Software\Classes ms-settings/mscfile writes) has very low false positive rates and should run at high confidence without tuning — legitimate software writes to HKLM\Software\Classes, not HKCU. For Linux, exclude specific CI/CD service accounts and package manager invocations by correlating AccountName with known automation accounts. Consider raising the bar for alerting by requiring the full bypass chain: registry write (staging) followed within 5 minutes by the auto-elevate binary execution, followed within 60 seconds by the suspicious child process — this three-event chain dramatically reduces false positives while maintaining detection of real attacks.

Hunting Queries

Hunt for the registry staging phase of UAC bypass attacks. Adversaries must write their payload command to HKCU\Software\Classes\ms-settings\shell\open\command (fodhelper/computerdefaults bypass) or HKCU\Software\Classes\mscfile\shell\open\command (eventvwr bypass) BEFORE triggering the auto-elevate binary. This query finds these registry writes independently of whether the bypass was subsequently executed, catching attackers who stage the bypass but haven't triggered it yet — or cases where AV/EDR terminated the child process before the process creation event fired.

Hunting — KQL

kql

// Hunt for registry staging writes that precede UAC bypass execution
// This finds the SETUP step that occurs before the auto-elevate binary fires
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "Software\\Classes"
| where RegistryKey has_any (
    "ms-settings", "mscfile", "Folder\\shell\\open",
    "exefile\\shell\\runas", "shell\\open\\command"
  )
| where RegistryKey !startswith "HKEY_LOCAL_MACHINE"
| extend IsUACBypassKey = RegistryKey has_any ("ms-settings", "mscfile")
| summarize
    FirstWrite = min(Timestamp),
    LastWrite = max(Timestamp),
    WriteCount = count(),
    Commands = make_set(RegistryValueData),
    KeysWritten = make_set(RegistryKey)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, IsUACBypassKey
| where WriteCount >= 1
| sort by IsUACBypassKey desc, LastWrite desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13)
| where match(TargetObject, "HKCU\\\\Software\\\\Classes\\\\(ms-settings|mscfile|Folder)")
| eval IsUACBypassKey=if(match(TargetObject, "(ms-settings|mscfile)"), 1, 0)
| eval RegistryAction=case(EventCode=12, "KeyCreate", EventCode=13, "ValueSet", true(), "Unknown")
| stats count as WriteCount, earliest(_time) as FirstWrite, latest(_time) as LastWrite,
    values(TargetObject) as KeysWritten, values(Details) as CommandValues
    by host, User, Image, CommandLine, IsUACBypassKey, RegistryAction
| sort - IsUACBypassKey, - LastWrite

Hunt for unusual integrity level elevation chains — processes running at High or System integrity whose parent was only Medium integrity, without passing through consent.exe. This catches novel UAC bypass techniques not yet in the known-binary list, since any legitimate UAC consent prompt would show consent.exe in the chain. Low occurrence parent-child pairs are prioritized (sort ascending) as rare combinations are more likely to be attacker-controlled rather than established software patterns.

Hunting — KQL

kql

// Hunt for processes with High/System integrity whose lineage includes unusual parent chains
// Specifically finds processes that skipped the consent.exe elevation dialog
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessIntegrityLevel in ("High", "System")
| where InitiatingProcessIntegrityLevel == "Medium"
| where FileName !in~ (
    "consent.exe", "dllhost.exe", "msiexec.exe", "TiWorker.exe",
    "wuauclt.exe", "WmiPrvSE.exe", "RuntimeBroker.exe", "taskhostw.exe"
  )
| where InitiatingProcessFileName !in~ (
    "services.exe", "svchost.exe", "lsass.exe", "wininit.exe",
    "csrss.exe", "smss.exe", "winlogon.exe", "explorer.exe"
  )
// Exclude known benign elevation patterns
| where not (FileName =~ "cmd.exe" and InitiatingProcessFileName =~ "explorer.exe" and ProcessCommandLine has "runas")
| summarize
    Occurrences = count(),
    Devices = dcount(DeviceName),
    Accounts = dcount(AccountName),
    SampleCmdLines = make_set(ProcessCommandLine, 5),
    SampleParents = make_set(InitiatingProcessFileName, 5)
    by FileName, InitiatingProcessFileName
| sort by Occurrences asc
// Low occurrence pairs are more suspicious — rare parent-child combos indicate novel bypass

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where NOT match(Image, "(consent|dllhost|msiexec|TiWorker|wuauclt|WmiPrvSE|RuntimeBroker|taskhostw)\.exe")
| where NOT match(ParentImage, "(services|svchost|lsass|wininit|csrss|smss|winlogon)\.exe")
| eval MandatoryLabel=coalesce(MandatoryLabel, "")
| where match(MandatoryLabel, "(High|System) Mandatory Level")
| eval ParentLabel=coalesce(ParentMandatoryLabel, "")
| where match(ParentLabel, "Medium Mandatory Level")
| stats count as Occurrences, dc(host) as Devices, dc(User) as Accounts,
    values(CommandLine) as SampleCmdLines by Image, ParentImage
| sort Occurrences asc

Hunt for Linux privilege escalation indicators: setuid binary discovery (find -perm -4000), sudo capability reconnaissance (sudo -l before actual escalation), setuid bit manipulation (chmod u+s), and GTFOBins-style sudo escape execution. The IsSudoList and IsGTFOBin flags together indicate a reconnaissance-to-execution pattern — an account discovering its sudo rights and then immediately using them to escape to a shell via a permitted binary like vim or python.

Hunting — KQL

kql

// Hunt for Linux privilege escalation: setuid binary discovery, sudo -l reconnaissance,
// and GTFOBins-style abuse patterns indicating privilege escalation preparation
DeviceProcessEvents
| where Timestamp > ago(7d)
| where OSPlatform == "Linux"
| where ProcessCommandLine has_any (
    // Setuid discovery
    "find / -perm -4000", "find / -perm /4000", "find / -perm -u=s",
    "find / -perm -2000", "find / -perm -6000",
    // Sudo capability discovery (classic pre-escalation recon)
    "sudo -l", "sudo --list",
    // Setuid bit setting
    "chmod u+s", "chmod +s", "chmod 4755", "chmod 4777", "chmod 6755",
    // GTFOBins sudo escape patterns
    "sudo find", "sudo vim", "sudo nano", "sudo less", "sudo more",
    "sudo awk", "sudo nmap", "sudo python", "sudo perl", "sudo ruby",
    "sudo zip", "sudo tar", "sudo cp /bin/sh", "sudo tee"
  )
| where AccountName !in ("root", "daemon", "_apt", "nobody", "systemd-network")
| summarize
    Count = count(),
    Commands = make_set(ProcessCommandLine, 10),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, FileName
| where Count >= 1
| extend IsRecon = Commands has_any ("sudo -l", "find / -perm")
| extend IsExecution = Commands has_any ("chmod +s", "sudo bash", "sudo python", "sudo vim")
| sort by IsExecution desc, IsRecon desc, Count desc

Hunting — SPL

spl

index=linux_secure OR index=syslog sourcetype="linux_secure"
("sudo" OR "su" OR "chmod")
| rex field=_raw "(?:COMMAND|command)=(?P<SudoCommand>[^\n]+)"
| rex field=_raw "user=(?P<SudoUser>[^\s]+)"
| eval IsSudoList=if(match(_raw, "sudo.*-l|sudo.*--list"), 1, 0)
| eval IsSetuidChange=if(match(_raw, "chmod.*(\\+s|4755|4777|6755|u\\+s)"), 1, 0)
| eval IsGTFOBin=if(match(SudoCommand, "(bash|sh|python|perl|ruby|vim|nano|less|more|find|awk|nmap|tee|cp)"), 1, 0)
| eval SuspicionScore=IsSudoList + IsSetuidChange + IsGTFOBin
| where SuspicionScore > 0 OR match(_raw, "sudo.*-s|sudo.*su")
| table _time, host, SudoUser, SudoCommand, IsSudoList, IsSetuidChange, IsGTFOBin, SuspicionScore, _raw
| sort - SuspicionScore, - _time

Atomic Red Team Tests

Test 1 Fodhelper UAC Bypass — Registry Staging and Execution

windows

Executes the classic fodhelper.exe UAC bypass. Writes a command payload to HKCU\Software\Classes\ms-settings\shell\open\command (with DelegateExecute trick), then launches fodhelper.exe which auto-elevates to High integrity and executes the staged command. The test runs whoami /groups to confirm High integrity elevation. This simulates the most common UAC bypass seen in malware including Agent Tesla, Formbook, and numerous commodity RATs.

Command

powershell

reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /d "cmd.exe /c whoami /groups > %TEMP%\uac-test-result.txt"
reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /v DelegateExecute /d ""
start /wait fodhelper.exe
timeout /t 3
type %TEMP%\uac-test-result.txt

Cleanup

powershell

reg delete HKCU\Software\Classes\ms-settings /f 2>nul
del %TEMP%\uac-test-result.txt 2>nul

Expected Telemetry

Sysmon Event ID 13 (RegistryValueSet): TargetObject containing HKCU\Software\Classes\ms-settings\shell\open\command, Details showing cmd.exe payload. Sysmon Event ID 1 (Process Create): Image=fodhelper.exe with MandatoryLabel=High Mandatory Level. Sysmon Event ID 1 again: ParentImage=fodhelper.exe, Image=cmd.exe, MandatoryLabel=High Mandatory Level — this is the UAC bypassed child. Security Event ID 4624 may show a new elevated token. MDE DeviceRegistryEvents will show ActionType=RegistryValueSet on the ms-settings key.

Expected Detection

KQL DetectionType=UAC_Bypass_Registry_Hijack_Prep fires on the registry write. Then UAC_Bypass_AutoElevate_Child fires when fodhelper spawns cmd.exe. SPL: FodhelperBypass=1, SuspicionScore >= 1. Both the registry staging and the process spawn should alert independently, allowing correlation of the full attack chain.

Test 2 Eventvwr UAC Bypass — mscfile COM Hijacking

windows

Executes the eventvwr.exe UAC bypass by hijacking the mscfile COM handler in the current user's registry hive. Windows Event Viewer is auto-elevated (marked autoElevate in its manifest) and launches .msc files via the mscfile shell association. By redirecting HKCU\Software\Classes\mscfile\shell\open\command to a custom executable, the attacker's command runs at High integrity when eventvwr.exe starts. This technique was popularized by James Forshaw and is used by groups including TA505.

Command

powershell

reg add HKCU\Software\Classes\mscfile\shell\open\command /f /ve /d "cmd.exe /c whoami /priv > %TEMP%\eventvwr-uac-test.txt"
start /wait eventvwr.exe
timeout /t 3
type %TEMP%\eventvwr-uac-test.txt

Cleanup

powershell

reg delete HKCU\Software\Classes\mscfile /f 2>nul
del %TEMP%\eventvwr-uac-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 13: TargetObject=HKCU\Software\Classes\mscfile\shell\open\command, Details=cmd.exe /c whoami /priv... Sysmon Event ID 1: Image=eventvwr.exe with MandatoryLabel=High Mandatory Level. Sysmon Event ID 1: ParentImage=eventvwr.exe, Image=cmd.exe, CommandLine containing whoami /priv, MandatoryLabel=High Mandatory Level. Security Event ID 4688 (if command line auditing enabled) with mandatory label showing High Integrity.

Expected Detection

KQL: DeviceRegistryEvents fires on mscfile key write (RiskScore=90). DeviceProcessEvents fires on eventvwr.exe spawning cmd.exe (EventvwrBypass detection). SPL: EventvwrBypass=1, SuspicionScore >= 1. The output file will contain elevated privileges including SeDebugPrivilege if the bypass succeeds, confirming full High integrity execution.

Test 3 Linux Setuid Bit Abuse — Copy Shell and Set SUID

linux

Demonstrates Linux privilege escalation via setuid bit manipulation. Copies /bin/bash to a temp location and sets the setuid bit, then executes it with -p flag to preserve the elevated EUID. This is a classic GTFOBins technique and mirrors real-world attacks where adversaries find writable directories containing setuid binaries or create new ones after gaining write access to system directories. Requires the test runner to have sudo rights.

Command

bash

cp /bin/bash /tmp/argus-suid-test
sudo chmod u+s /tmp/argus-suid-test
ls -la /tmp/argus-suid-test
/tmp/argus-suid-test -p -c 'id; whoami'

Cleanup

bash

sudo rm -f /tmp/argus-suid-test

Expected Telemetry

MDE DeviceProcessEvents (Linux): ProcessCommandLine containing 'chmod u+s /tmp/argus-suid-test'. Follow-on process event showing /tmp/argus-suid-test -p -c 'id; whoami' with AccountName of the test runner but effective UID of root in output. Linux audit log (auditd): SYSCALL records for chmod with mode=104755 (setuid+755), PATH record for the target file. /var/log/auth.log: sudo session opened for command /bin/chmod. Sysmon for Linux (if deployed): Event ID 1 showing chmod command, Event ID 1 showing suid binary execution.

Expected Detection

KQL LinuxPrivEsc fires on 'chmod u+s' in ProcessCommandLine. SPL linux_secure query catches the sudo chmod invocation via PAM logs. Hunting query IsSetuidChange=1 and IsExecution=1 both trigger. The combination of 'chmod +s' followed within minutes by execution of the newly created setuid binary from /tmp (not a standard system path) is a high-confidence indicator.

Test 4 Sudo GTFOBins Privilege Escalation — Python Breakout

linux

Demonstrates abuse of a misconfigured sudo entry allowing a non-root user to run python as root without a password (NOPASSWD). This mirrors real-world misconfigurations found in development servers, CTF environments, and cloud instances where sudo rules are overly permissive. The Python spawn technique is a classic GTFOBins method for escaping restricted sudo commands to a full root shell. Requires pre-configuring /etc/sudoers with a NOPASSWD python entry for the test user.

Command

bash

# Pre-requisite: add to /etc/sudoers (as root):
# testuser ALL=(ALL) NOPASSWD: /usr/bin/python3
# Then run as testuser:
sudo python3 -c 'import os; os.setuid(0); os.system("id && whoami && cat /etc/shadow | head -3")'

Cleanup

bash

# Remove the sudoers entry added in pre-requisite
# sudo visudo and delete the testuser NOPASSWD line

Expected Telemetry

Linux auth.log: sudo session opened for user root by testuser(uid=1000), COMMAND=/usr/bin/python3 -c import os... MDE DeviceProcessEvents (Linux): ProcessCommandLine='sudo python3 -c import os; os.setuid(0); os.system(id && whoami && cat /etc/shadow...' with AccountName=testuser. Auditd: SYSCALL setuid with uid=0 result=success from python3 process. The os.system('cat /etc/shadow') represents credential access following privilege escalation.

Expected Detection

KQL LinuxPrivEsc fires on 'sudo python' in ProcessCommandLine. SPL linux_secure: IsGTFOBin=1, SuspicionScore >= 1. Hunting query flags 'sudo python' as a GTFOBins escape pattern. If the account previously ran 'sudo -l' (reconnaissance), the hunting query would show IsRecon=1 and IsGTFOBin=1 on the same AccountName, indicating a reconnaissance-to-exploitation sequence.

Test 5 sdclt UAC Bypass — Folder Shell Command Hijacking

windows

Exploits the sdclt.exe (Windows Backup application) auto-elevation behavior by hijacking the HKCU\Software\Classes\Folder\shell\open\command registry key. When sdclt.exe starts with the /kickoffelev parameter or normally, it triggers COM object lookups that resolve to the user-controlled HKCU hive, allowing command execution at High integrity without a UAC prompt. This technique was discovered by Matthew Graeber and is distinct from the ms-settings/mscfile bypass methods.

Command

powershell

reg add "HKCU\Software\Classes\Folder\shell\open\command" /f /ve /d "cmd.exe /c whoami /groups > %TEMP%\sdclt-uac-test.txt"
reg add "HKCU\Software\Classes\Folder\shell\open\command" /f /v DelegateExecute /d ""
start /wait sdclt.exe /kickoffelev
timeout /t 5
type %TEMP%\sdclt-uac-test.txt

Cleanup

powershell

reg delete "HKCU\Software\Classes\Folder\shell\open\command" /f 2>nul
del %TEMP%\sdclt-uac-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 13: TargetObject=HKCU\Software\Classes\Folder\shell\open\command, Details=cmd.exe /c whoami /groups... Sysmon Event ID 1: Image=sdclt.exe with ProcessCommandLine containing /kickoffelev. Sysmon Event ID 1: ParentImage=sdclt.exe, Image=cmd.exe, MandatoryLabel=High Mandatory Level. MDE DeviceRegistryEvents: ActionType=RegistryValueSet on the Folder\shell\open\command key. If UAC bypass succeeds, whoami /groups output will show 'Mandatory Label\High Mandatory Level Label'.

Expected Detection

KQL: DeviceRegistryEvents catches Folder\shell\open\command write (RiskScore=90 registry hijack prep). DeviceProcessEvents fires on sdclt.exe spawning cmd.exe (UAC_Bypass_AutoElevate_Child). SPL: SdcltBypass=1, SuspicionScore >= 1. The /kickoffelev parameter in sdclt.exe command line is itself an anomaly indicator that can be added to a dedicated SPL eval clause for additional signal fidelity.

Related Detections

Tactic Hubs

TA0004Privilege Escalation TA0005Defense Evasion

Sub-techniques (6)

Related Techniques

T1548.001Setuid and Setgid T1548.002Bypass User Account Control T1548.003Sudo and Sudo Caching T1548.004Elevated Execution with Prompt T1548.005Temporary Elevated Cloud Access T1548.006TCC Manipulation T1055Process Injection T1218.011Rundll32 T1543.003Windows Service T1053.005Scheduled Task T1112Modify Registry T1562.001Disable or Modify Tools

What is T1548 Abuse Elevation Control Mechanism?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1548

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Sub-techniques (6)

Related Techniques

Same Tactic: Privilege Escalation

Popular Detections

Get new detections in your inbox