How do you detect privilege escalation?

Detect local privilege escalation by alerting on known patterns: UAC-bypass registry hijacks (e.g. ms-settings shell-open command read by fodhelper/computerdefaults), a kernel driver written then loaded (Sysmon 6) cross-referenced against LOLDrivers for BYOVD, token manipulation (unexpected SeDebug/SeImpersonate use and named-pipe impersonation), weak-ACL or unquoted-path service modifications, and anomalous sensitive-privilege assignment (Event 4672/4673). Enable Microsoft's Vulnerable Driver Blocklist and HVCI. SigmaHQ and LOLDrivers provide vetted references.

Detecting Privilege Escalation: UAC Bypass, Token Abuse and BYOVD

After a foothold, attackers climb: UAC bypasses, token manipulation, dangerous privileges, and kernel access via vulnerable drivers. This pack covers detecting that escalation on Windows. It complements our AD CS and Active Directory detection coverage for domain escalation.

Signals at a Glance

Technique	Signal	ATT&CK
UAC bypass	fodhelper/eventvwr/computerdefaults writing hijack registry keys	T1548.002
BYOVD	Known-vulnerable driver written then loaded (Sysmon 6)	T1068
Token manipulation	Process using SeDebug/SeImpersonate; named-pipe impersonation	T1134
Service-based	Unquoted-path / weak-ACL service modified to run attacker binary	T1543.003
Privilege use	Event 4672/4673/4674 anomalous sensitive-privilege assignment	T1134

UAC Bypass

Many UAC bypasses hijack a registry key that a signed auto-elevating binary reads. Alert on the known patterns — e.g. fodhelper.exe reading a hijacked ms-settings shell-open command:

title: UAC Bypass via fodhelper / ms-settings Hijack
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Software\Classes\ms-settings\Shell\Open\command'
    condition: selection
level: high
---
# Correlate with: fodhelper.exe or computerdefaults.exe spawning a child process

Drivers & Tokens

Alert on a kernel driver written to disk and then loaded (Sysmon 6), cross-reference against the LOLDrivers list, and enable Microsoft’s Vulnerable Driver Blocklist and HVCI (see BYOVD).
Detect token abuse: processes acquiring and using SeDebugPrivilege/SeImpersonatePrivilege unexpectedly, and named-pipe impersonation (“potato”-style) from service accounts.
Hunt for service modifications (unquoted paths, weak ACLs) that repoint a service at an attacker binary, and alert on anomalous Event 4672/4673 sensitive-privilege assignment.

Vetted sources

SigmaHQ covers UAC-bypass registry patterns, vulnerable-driver loads and token abuse; the LOLDrivers project is the vulnerable-driver reference.

Detect the Climb to SYSTEM

Mjolnir Security helps organisations detect local and domain privilege escalation.

Detection EngineeringManaged Detection & ResponseEndpoint HardeningThreat HuntingIncident Response

Detection Engineering Building UAC-bypass, driver and token-abuse detections.
Managed Detection and Response Monitoring endpoints for escalation attempts.
24/7 Incident Response Containment when escalation is detected. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026