detecting-t1548-abuse-elevation-control-mechanism
Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry changes, integrity-level transitions, and parent-child process relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation activity or validating elevation-abuse detection coverage.
SKILL.md
The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.