saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/detecting-t1548-abuse-elevation-control-mechanism/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.5 KiB
Raw Blame History

API Reference: T1548 Abuse Elevation Control Mechanism

MITRE ATT&CK T1548 Sub-Techniques

Sub-technique Name Platform
T1548.001 Setuid and Setgid Linux/macOS
T1548.002 Bypass User Account Control Windows
T1548.003 Sudo and Sudo Caching Linux/macOS
T1548.004 Elevated Execution with Prompt macOS

UAC Bypass — Auto-Elevate Binaries

Known Auto-Elevate Targets

Binary Bypass Method
fodhelper.exe Registry key hijack
computerdefaults.exe ms-settings handler
eventvwr.exe mscfile handler
sdclt.exe App paths hijack
wsreset.exe Bypasses defender
cmstp.exe INF file execution

Registry Keys for UAC Bypass

HKCU\Software\Classes\ms-settings\Shell\Open\command
HKCU\Software\Classes\mscfile\Shell\Open\command

Windows UAC Configuration

Check UAC Level

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
# EnableLUA = 1 (UAC enabled)
# ConsentPromptBehaviorAdmin = 0-5

ConsentPromptBehaviorAdmin Values

Value Behavior
0 Elevate without prompting
1 Prompt for credentials on secure desktop
2 Prompt for consent on secure desktop
5 Prompt for consent (default)

Linux Privilege Escalation

sudo Configuration Check

sudo -l                    # List allowed commands
cat /etc/sudoers           # Full sudoers file
visudo -c                  # Validate syntax

Find SUID Binaries

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null   # SGID

GTFOBins Sudo Escapes

Binary Escape
vim sudo vim -c ':!/bin/bash'
find sudo find . -exec /bin/bash \;
python sudo python -c 'import os; os.system("/bin/bash")'
nmap sudo nmap --interactive (old versions)

Sysmon Detection Rules

Event 13 — Registry Value Set

<RegistryEvent onmatch="include">
  <TargetObject condition="contains">ms-settings\Shell\Open\command</TargetObject>
  <TargetObject condition="contains">mscfile\Shell\Open\command</TargetObject>
</RegistryEvent>

Sigma Rule — UAC Bypass

title: UAC Bypass via Fodhelper
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'ms-settings\Shell\Open\command'
    condition: selection
level: critical