domains / families / security / detecting-t1548-abuse-elevation-control-mechanism

detecting-t1548-abuse-elevation-control-mechanism

separate

Detect abuse of elevation control mechanisms (T1548), including Windows UAC

When to use

• When hunting for privilege escalation via UAC bypass in Windows environments
• After threat intelligence indicates use of UAC bypass exploits by active threat groups
• When investigating how attackers achieved administrative access without triggering UAC prompts
• During security assessments to validate UAC bypass detection coverage
• When monitoring for setuid/setgid abuse on Linux systems

Skill page

Source