How do you detect a UAC bypass?

Detect UAC bypass at two choke points. First, alert on writes to the per-user registry keys that auto-elevating binaries read (ms-settings, mscfile and Folder shell open command), which Sysmon logs under HKU SID_Classes. Second, alert on an auto-elevating parent such as fodhelper.exe, computerdefaults.exe, eventvwr.exe or sdclt.exe launching cmd, PowerShell or a script host, and on high-integrity processes whose parent ran with a limited token and no consent prompt. Validate coverage with UACME and Atomic Red Team, and prevent the problem by running users as standard accounts.

Detecting UAC Bypass: Auto-Elevate Binaries and Registry Hijacks

Most UAC bypasses follow one pattern: a Windows binary marked to auto-elevate reads a per-user registry key before it launches a child, and the attacker writes a command into that key first. Because the key lives under HKCU, no elevation is needed to plant it. That gives defenders two reliable choke points: the registry write and the unusual child of an auto-elevating parent (T1548.002).

Signals at a Glance

Signal	Where	ATT&CK
Write to HKCU ms-settings, mscfile or Folder shell open command keys	Sysmon 12/13, EDR registry	T1548.002
Auto-elevating binary (fodhelper, computerdefaults, eventvwr, sdclt) spawning a shell or script host	Sysmon 1, Event 4688	T1548.002
High-integrity child of a medium-integrity parent with no consent prompt	Sysmon 1 IntegrityLevel, 4688 token elevation type	T1548.002
Empty DelegateExecute value written beside a command value	Sysmon 13	T1548.002
Key created then deleted within seconds (cleanup)	Sysmon 12/13/14	T1112

The Registry Hijack

fodhelper.exe and computerdefaults.exe resolve the ms-settings handler, eventvwr.exe resolves mscfile, and sdclt.exe resolves Folder or an App Paths entry. Each checks HKCU before HKLM, so a command written under HKCU runs at high integrity when the binary starts. Sysmon records HKCU as HKU\<SID>_Classes, which is the string to match:

title: UAC Bypass via Auto-Elevate Registry Hijack
status: experimental
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - '_Classes\ms-settings\shell\open\command'
      - '_Classes\mscfile\shell\open\command'
      - '_Classes\Folder\shell\open\command'
      - '_Classes\exefile\shell\runas\command'
  condition: selection
level: high
# tune/validate: per-user changes to these exact keys are rare, but confirm
# against your software inventory before enabling as a blocking control.

Process Lineage and Integrity

When the registry write is missed, the execution is not. An auto-elevating parent should not launch a command interpreter, and the child should not arrive at high integrity without a consent.exe prompt in the chain:

// Microsoft Defender / Sentinel (KQL) - auto-elevate parent spawning an interpreter
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("fodhelper.exe","computerdefaults.exe","eventvwr.exe","sdclt.exe","slui.exe","cmstp.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
          FileName, ProcessCommandLine, ProcessIntegrityLevel
// tune/validate: eventvwr.exe legitimately launches mmc.exe, so keep mmc out of the child list.

Variants worth covering: the DiskCleanup scheduled task abused through a windir value in HKCU Environment, CMSTP.exe with a crafted INF, and COM elevation monikers such as ICMLuaUtil.
The UACME project catalogues dozens of methods; use it in a lab to generate telemetry for each one your EDR claims to cover, instead of trusting the claim.
Event 4688 carries a token elevation type; a full-token process whose parent ran with a limited token is the generic signal that survives new bypass variants.
Preventive controls matter more than detection here: run users as standard accounts, and set the UAC prompt for administrators to require credentials on the secure desktop.

Vetted sources

Use the SigmaHQ registry-set and process-creation rules for UAC bypass, Elastic’s prebuilt rules for UAC bypass via registry modification, the UACME catalogue for test cases, and Atomic Red Team T1548.002 for validation. Baseline your own environment first — some endpoint management agents write to these keys.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

The Registry Hijack

Process Lineage and Integrity

Build Detections That Fire

Privilege Escalation Detection

Detection Hub

AlwaysInstallElevated Detection