---
name: detect-windows-privesc
description: "Detection and hardening methodology for Windows local privilege escalation via access-token manipulation, weak or hijackable services, and UAC bypass (MITRE ATT&CK T1134, T1134.001, T1134.002, T1134.003, T1543.003, T1574.009, T1574.010, T1574.011, T1548.002, T1068). Keys off the Windows Security log (Event IDs 4688, 4672, 4673, 4697, 4703, 4624, 4648), System log Service Control Manager events 7045 and 7040, and Sysmon (1, 6, 7, 10, 12, 13, 17, 18). Gives the defender view of a privesc chain, the events to watch, a hypothesis-driven hunt, links to public rule sources, and a framework-mapped hardening plan. Use when investigating a suspected local admin or SYSTEM escalation, triaging a fodhelper or eventvwr UAC-bypass or Potato token-impersonation alert, auditing service permissions and unquoted paths, hunting integrity-level jumps, writing Windows privesc detections, or hardening UAC, services, and local admin rights."
---

# Windows Privilege Escalation (Token, Service, UAC Bypass) - Defensive Methodology

> **Tier 2 - methodology skill.** No bespoke UMBRASEC detection rule ships with this skill yet. It gives the defender's method, the log sources and signals, the hunt, and the hardening, and points to public rule sources. Promotion to Tier 1 (a sourced, tuned UMBRASEC rule) is tracked in [COVERAGE.md](https://github.com/umbrasec-labs/umbra-blue/blob/main/COVERAGE.md). Do not treat the content below as citing a UMBRASEC rule; there is none for this threat yet.

## TL;DR for defenders

An attacker who already has a low-privileged foothold on Windows looks for three cheap paths to local administrator or SYSTEM: steal or impersonate a more privileged process token (the classic "Potato" family abusing `SeImpersonatePrivilege` on service accounts), abuse a service whose binary, folder, registry key, or unquoted path they can write (so their payload runs as the service account, usually SYSTEM), or run an auto-elevating Windows binary to bypass UAC and jump from medium to high integrity without a consent prompt. In telemetry the common tell is an integrity-level or token jump that did not come through a legitimate elevation: a process running at High or System integrity whose parent is a medium-integrity user process or an auto-elevating LOLBin, a new or modified service pointing at an attacker-writable path, or a special-privilege logon that your baseline does not expect. Turn on process creation auditing with command line, service installation auditing, and Sysmon, then alert on the privilege and integrity transitions below rather than on any single binary name. Patch the perennial local-privesc bugs (PrintNightmare, the vulnerable-driver and installer CVEs) fast, remove `SeImpersonatePrivilege` and admin rights where they are not needed, and lock service and UAC configuration down.

## What it looks like, defender view

In normal operation, elevation on Windows is explicit and consistent: an administrator triggers a UAC consent prompt, `consent.exe` runs, and a high-integrity process is parented to a known elevation path. Services start from signed binaries in protected directories (`%SystemRoot%`, `%ProgramFiles%`) that rarely change outside patching, and service accounts that hold `SeImpersonatePrivilege` (IIS, SQL, MSSQL) spawn a stable, known set of children. An escalation attempt breaks one of those baselines. A token attack shows a service-account process (for example `w3wp.exe` or a SQL host) suddenly spawning `cmd.exe`, `powershell.exe`, or an unknown binary at System integrity, often preceded by named-pipe activity used to coerce and impersonate a SYSTEM token. A service attack shows a service binary path, its `ImagePath` registry value, or a file in a service directory being written by a non-admin, then a SYSTEM child process launched by the Service Control Manager. A UAC bypass shows an auto-elevating trusted binary (`fodhelper.exe`, `eventvwr.exe`, `sdclt.exe`, `computerdefaults.exe`, `wsreset.exe`) spawning a high-integrity child after a current-user registry key (`HKCU\Software\Classes\...\shell\open\command` or an `ms-settings` / `Folder` handler) was written moments earlier, with no `consent.exe` prompt in between. This skill explains the technique only to the depth needed to catch and reduce it; it ships no escalation tooling.

## Log sources and signals

- **Windows Security log** is the primary source; enable the advanced audit subcategories that produce these events:
  - **Event ID 4688, Process creation.** Enable command-line capture (`Include command line in process creation events`). The decisive fields are `NewProcessName`, `ParentProcessName`, `TokenElevationType` (`%%1936` / Type 1 full token, seen with UAC off, the built-in Administrator, or a service account; `%%1937` / Type 2 elevated token, from Run as administrator or auto-elevation; `%%1938` / Type 3 limited token, the normal UAC default for an admin), `SubjectUserSid`, and `MandatoryLabel` where present. A Type 2 elevated process whose lineage contains no `consent.exe` is the UAC-bypass tell; the service-account-spawns-shell pattern also surfaces here.
  - **Event ID 4672, Special privileges assigned to new logon**, and **4673, A privileged service was called.** Watch the `PrivilegeList` for `SeImpersonatePrivilege`, `SeAssignPrimaryTokenPrivilege`, `SeDebugPrivilege`, `SeTcbPrivilege`, and `SeCreateTokenPrivilege`. A logon or process acquiring these privileges outside your known service accounts and admins is the token-manipulation signal.
  - **Event ID 4703, A token right was adjusted** (where the subcategory is enabled), and **4624 / 4648** logons. For token theft look at `LogonType 3` SYSTEM logons sourced from a named pipe, and `4648` explicit-credential use that does not match an interactive admin.
  - **Event ID 4697, A service was installed in the system** (Security log, requires the `Security System Extension` / service-install audit subcategory). Fields: `ServiceName`, `ServiceFileName`, `ServiceType`, `ServiceStartType`, `ServiceAccount`.
  - **Event ID 4657, A registry value was modified**, when SACL auditing covers `HKLM\SYSTEM\CurrentControlSet\Services\*` (service `ImagePath`, `FailureCommand`) and the UAC-bypass handler keys under `HKCU`.
- **System log, Service Control Manager.** **Event ID 7045, A service was installed** (fires without extra audit policy), and **7040, service start type changed**, and **7036 / 7009** for state and timeout. 7045 pointing at a user-writable path, a `cmd`/`powershell` command line, or an unquoted path with spaces is high value.
- **Sysmon** adds the lineage and registry detail the Security log lacks:
  - **Event ID 1, ProcessCreate** carries `IntegrityLevel` (Medium, High, System), `ParentImage`, `OriginalFileName`, `CommandLine`, and `User`. The core signal is an integrity jump (Medium parent to High/System child) through an unexpected parent.
  - **Event ID 6, DriverLoad** and **7, ImageLoad** catch bring-your-own-vulnerable-driver (BYOVD) and DLL-side-load paths used for T1068.
  - **Event ID 10, ProcessAccess** catches high-privilege handle opens (for example to `lsass.exe`) tied to token theft; `GrantedAccess` and `CallTrace` are the fields.
  - **Event ID 12 / 13 / 14, Registry** catch the UAC-bypass handler writes under `HKCU\Software\Classes` and the service `ImagePath` tampering under `HKLM`.
  - **Event ID 17 / 18, Pipe Created / Pipe Connected** catch the named-pipe coercion used by the Potato token-impersonation family; `PipeName` is the field.
- **EDR / osquery.** Process lineage with integrity and token data, the `services` table for binary paths and start types, and `ntfs_acl_permissions` / configuration checks for writable service binaries and directories support baselining.

What normal looks like: elevation preceded by `consent.exe`; services installed only by patching or deployment tooling from protected directories; `SeImpersonatePrivilege` held by a fixed set of service accounts that spawn a known set of children; service `ImagePath` values that are quoted and point inside `%SystemRoot%` or `%ProgramFiles%` and change only during maintenance. Deviation from those baselines is the anomaly.

## Detection approach

Alert on the transition, not on the binary name alone.

- **Token manipulation.** Alert when a known-impersonation service account (IIS `w3wp.exe`, SQL Server, MSSQL, print spooler) spawns an interactive shell or unexpected binary at System integrity, especially when preceded by Sysmon Event ID 17/18 named-pipe activity. Flag any process acquiring `SeImpersonatePrivilege`, `SeAssignPrimaryTokenPrivilege`, or `SeDebugPrivilege` (4672/4673) outside your baseline, and any `4624` LogonType 3 logon with `TargetUserName` SYSTEM, `IpAddress` 127.0.0.1 or ::1, and `AuthenticationPackageName` NTLM (the loopback shape behind pipe-coercion token attacks).
- **Service abuse.** Alert on `7045`/`4697` service installs whose `ServiceFileName` points at a user-writable or temp path, carries a `cmd`/`powershell`/`rundll32` command line, or is an unquoted path containing spaces (the T1574.009 hijack shape). Alert on `4657`/Sysmon 13 modifications of `HKLM\SYSTEM\CurrentControlSet\Services\*\ImagePath` outside change management, and on writes (Sysmon Event ID 11) into a service's binary directory by a non-admin.
- **UAC bypass.** Alert when an auto-elevating trusted binary (`fodhelper.exe`, `eventvwr.exe`, `sdclt.exe`, `computerdefaults.exe`, `wsreset.exe`, `slui.exe`) spawns a High-integrity child with no `consent.exe` in the lineage, and correlate with a Sysmon Event ID 12/13 write to the matching `HKCU\Software\Classes\...\shell\open\command`, `ms-settings\shell\open\command`, or `Folder\shell\open\command` handler in the preceding seconds.
- **Exploitation (T1068).** Alert on Sysmon Event ID 6 loads of known-vulnerable drivers (cross-reference the LOLDrivers list) and on the PrintNightmare shape (spoolsv.exe writing or loading a DLL from a user path).

A tuned UMBRASEC rule is not yet shipped for this threat. Use maintained public rules as the starting point and tune them to your baseline:

- SigmaHQ Windows rules, especially process-creation, registry, and builtin service-install sets: <https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation>, <https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry>, and <https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin> (includes fodhelper/eventvwr/sdclt UAC-bypass, Potato-style token impersonation, and suspicious 7045 service-install rules).
- Elastic prebuilt detection rules for Windows, including UAC bypass, token impersonation, service-path and unquoted-path, and vulnerable-driver coverage: <https://github.com/elastic/detection-rules/tree/main/rules/windows>.
- LOLDrivers, the public reference for known-vulnerable drivers to prioritise for the T1068 path: <https://www.loldrivers.io/>.

## Threat hunt

Hypothesis: a low-privileged account has escalated to local administrator or SYSTEM through a token, service, or UAC-bypass path, and a single quiet escalation did not trip a velocity alert.

1. **Baseline the surface.** Enumerate services whose binary path, parent directory, or registry key is writable by non-admins, and whose `ImagePath` is unquoted with spaces (via osquery `services` joined to ACL checks, or an authorised configuration sweep). Anything writable is a lead.
2. **Integrity jumps.** Over a long window, pull Sysmon Event ID 1 (or 4688) where child `IntegrityLevel` is High or System and `ParentImage` is a medium-integrity user process or an auto-elevating LOLBin, group by parent and host, and exclude known elevation paths (`consent.exe` lineage, deployment tooling).
3. **Privilege acquisition.** Pull 4672/4673 for `SeImpersonatePrivilege`, `SeAssignPrimaryTokenPrivilege`, and `SeDebugPrivilege` grants and subtract your known service accounts and admins; join the survivors to the process that received them.
4. **Service installs and tampering.** List every 7045/4697 and every `ImagePath` modification (4657 / Sysmon 13) for the window, and timeline them against the change-management record; anything not tied to patching or a deployment job is suspect.
5. **UAC-bypass correlation.** For each auto-elevating LOLBin that spawned a High-integrity child, look back for the matching `HKCU` handler write (Sysmon 12/13); the pair in sequence is high confidence.
6. **Correlate to parent and user.** A SYSTEM or High-integrity process whose parent is an unprivileged user session, a web server, or a service account that should not spawn shells is the escalation to chase.

## Hardening

Shrink the surface so a foothold does not reach administrator or SYSTEM. These controls ground in the UMBRASEC [foundation guide](https://umbrasec.dev/guide/foundation.html) Essential Eight baseline and the [identity and access guide](https://umbrasec.dev/guide/identity-and-access.html); a cell is left blank where no single control maps cleanly.

| Control | What it does | Essential Eight | ISO 27001:2022 | NIST CSF 2.0 |
|---|---|---|---|---|
| Restrict admin and impersonation rights | Remove local admin from standard users and strip `SeImpersonatePrivilege` / `SeAssignPrimaryTokenPrivilege` from accounts that do not need them, so token theft has nothing to steal | Restrict administrative privileges | A.8.2 Privileged access rights | PR.AA-05 Least privilege |
| Patch local-privesc bugs fast | Shut the window on PrintNightmare, vulnerable installers, and BYOVD CVEs that escalate with no remote access | Patch operating systems | A.8.8 Technical vulnerabilities | ID.RA; PR.PS Platform Security |
| Fix service permissions and unquoted paths | Quote all service `ImagePath` values, remove write access to service binaries, their folders, and their registry keys from non-admins | - | A.8.19 Software on systems | PR.PS Platform Security |
| Enforce and raise UAC | Set UAC to the highest prompt level, enable secure desktop, and avoid auto-elevation exceptions, so the bypass LOLBins no longer silently elevate | - | A.8.2 Privileged access rights | PR.PS Platform Security |
| Application and driver control | Block the known UAC-bypass LOLBins and vulnerable drivers from executing with WDAC/AppLocker and the Microsoft vulnerable-driver blocklist | Application control | A.8.19 Software on systems | PR.PS Platform Security |
| Unique local admin passwords (LAPS) | Randomise and rotate local administrator passwords so a stolen local admin credential does not pivot across the estate | - | A.5.17 Authentication information | PR.AA-01 |

Alongside the table: enable Credential Guard and run service accounts as group Managed Service Accounts (gMSAs) with the least privilege they need, and prefer protected process / PPL settings for sensitive services. These map to MITRE D3FEND countermeasures (below) rather than to a single Essential Eight strategy.

## Honest limitations

A patient attacker who escalates once, quietly, through a legitimate-looking path may produce only a single integrity jump that is easy to lose in a busy estate, which is why baselining known elevation paths and service-account children matters. Token-only attacks that never spawn a shell (duplicating a token inside an existing process) can leave little beyond the privilege grant in step 3 and the named-pipe artefact, so EDR in-memory telemetry carries the load there. Kernel and driver exploits (T1068) can escalate through a memory bug that touches no service or UAC artefact, surfacing mainly as a driver load and an anomalous SYSTEM process. Legitimate deployment tooling, patch agents, and management software install services and elevate constantly and will dominate false positives until allowlisted. Command-line auditing and Sysmon can be degraded by an attacker who already holds SYSTEM, so treat the logs as evidence up to the moment of compromise, not after. Baseline every rule in report-only mode before you alert, and treat every threshold as a dial.

## ATT&CK and D3FEND

- MITRE ATT&CK: [T1134 Access Token Manipulation](https://attack.mitre.org/techniques/T1134/) with [T1134.001 Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001/), [T1134.002 Create Process with Token](https://attack.mitre.org/techniques/T1134/002/), and [T1134.003 Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003/); [T1543.003 Create or Modify System Process: Windows Service](https://attack.mitre.org/techniques/T1543/003/); [T1574.009 Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009/), [T1574.010 Services File Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/), and [T1574.011 Services Registry Permissions Weakness](https://attack.mitre.org/techniques/T1574/011/); [T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002/); and [T1068 Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/).
- MITRE D3FEND countermeasures: Executable Allowlisting (D3-EAL), Process Spawn Analysis (D3-PSA), Local File Permissions (D3-LFP), and System Call Analysis (D3-SCA). See <https://d3fend.mitre.org/>.
- Public rule sources: SigmaHQ Windows (<https://github.com/SigmaHQ/sigma/tree/master/rules/windows>), Elastic detection-rules Windows (<https://github.com/elastic/detection-rules/tree/main/rules/windows>), LOLDrivers (<https://www.loldrivers.io/>).
- Reference CVEs for the known-exploit shapes: CVE-2021-34527 and CVE-2021-1675 (PrintNightmare, print spooler), CVE-2021-36934 (HiveNightmare / SAM readable by non-admins).

**Scope note.** This is a defensive skill. It explains Windows privilege escalation only to the depth needed to detect and mitigate it, and ships no escalation, token-theft, or bypass tooling; UMBRASEC publishes defense, not offense.