T1548
Abuse Elevation Control Mechanism
Adversaries may abuse elevation control mechanisms like UAC bypass to gain higher privileges without prompting users.
ATT&CK / Privilege Escalation
Many commodity malware families use UAC bypass techniques to elevate privileges silently, such as the fodhelper bypass.
Defense strategies
- Set UAC to highest level
- Remove admin rights from standard users
- Monitor for bypass techniques
- Enable virtualization-based security
Detection methods
- Monitor for UAC bypass indicators
- Track auto-elevation binaries
- Detect suspicious COM object access
D3FEND mappings
1