detecting-t1548-abuse-elevation-control-mechanism

name	detecting-t1548-abuse-elevation-control-mechanism
description	Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships. Use when detecting abuse of elevation control mechanisms including uac bypass, sudo.
domain	cybersecurity
tags	["threat-hunting","uac-bypass","privilege-escalation","mitre-t1548","elevation-control","windows-security"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Detecting T1548 Abuse Elevation Control Mechanism

Overview

Cybersecurity skill for detecting t1548 abuse elevation control mechanism. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting t1548 abuse elevation control mechanism"

• "When hunting for privilege escalation via UAC bypass in Windows environments"

• "After threat intelligence indicates use of UAC bypass exploits by active threat"

• "When investigating how attackers achieved administrative access without triggeri"

• When hunting for privilege escalation via UAC bypass in Windows environments

• After threat intelligence indicates use of UAC bypass exploits by active threat groups

• When investigating how attackers achieved administrative access without triggering UAC prompts

• During security assessments to validate UAC bypass detection coverage

• When monitoring for setuid/setgid abuse on Linux systems

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Sysmon Event ID 1 with command-line and parent process logging
• Windows Security Event ID 4688 with process tracking
• Registry auditing for UAC-related keys (HKCU\Software\Classes)
• Sysmon Event ID 12/13 (Registry key/value modification)
• EDR with elevation monitoring capabilities

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}