UAC Bypass — HKCU Registry Hijack Response
When UAC bypass is suspected via HKCU registry key hijack using the fodhelper, computerdefaults, eventvwr, or SilentCleanup vector, performs evidence collection, containment, and hardening steps.
ms-settings\Shell\Open\command) executes code at high integrity level without requiring administrator privileges. During response, use Process Monitor to examine HKCU keys that return NAME NOT FOUND results, and compare them against the legitimate list of AutoElevate applications. Numerous variants of this technique are documented under MITRE ATT&CK T1548.002.Prepare
4 steps- Sysmon telemetry validation
Periodically verify that EID 12/13 (RegistryEvent) keys `HKCU\Software\Classes\ms-settings\Shell\Open\command`, `mscfile\shell\open\command`, and `HKCU\Environment\windir` are being forwarded to SIEM, and that the `IntegrityLevel` field is being collected in EID 1.
- Detection rule deployment status
Confirm that UAC bypass HKCU registry write and auto-elevate binary child process rules (fodhelper, eventvwr, computerdefaults, sdclt, SilentCleanup) are active and calibrated; this playbook depends on live rules.
- Escalation chain
Document the SOC L1 → IR Lead → System owner chain; host isolation cannot be taken by L1 alone.
- Behavioral baseline reference
Pre-document whether fodhelper or computerdefaults runs in a legitimate administrative context in the environment; facilitates detection of unexpected child processes.
Detect & Analyze
6 steps- Identify source process of triggering alert