Abuse Elevation Control Mechanism

Adversaries may abuse elevation control mechanisms like UAC bypass to gain higher privileges without prompting users.

Many commodity malware families use UAC bypass techniques to elevate privileges silently, such as the fodhelper bypass.

• Set UAC to highest level
• Remove admin rights from standard users
• Monitor for bypass techniques
• Enable virtualization-based security

• Monitor for UAC bypass indicators
• Track auto-elevation binaries
• Detect suspicious COM object access