W-UAC-BYPASSPrivilege Escalation

UAC Bypass

fodhelper / computerdefaults / silentcleanup / sdclt — abuse autoElevate trustees to run as elevated administrator without prompt.

§ Where this technique fits

W-UAC-BYPASS is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

UAC bypass → elevated admin on a workstation
Standard medium-integrity admin user runs fodhelper / silentcleanup / computerdefaults auto-elevate bypass — gets a high-integrity session without a UAC prompt.
step 2 / 5

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

UAC bypass → elevated admin on a workstation

§ What commonly comes next