After responding to an alert involving unauthorized access to payroll data, forensic analyst Jason Miller...

The evidence points to a User Account Control bypass. In CEH coverage of Windows privilege escalation, UAC is a protection mechanism intended to prevent silent elevation of privileges, typically prompting the user when an action requires administrative rights. However, certain Windows binaries are “auto-elevate” (often trusted, signed Microsoft executables) and can run with elevated privileges under specific conditions without showing a UAC prompt. Attackers abuse this behavior by manipulating user-writable registry locations—commonly under the current user hive—to influence how these trusted binaries launch other components.

The scenario describes exactly that pattern: a non-elevated process starts an auto-elevate executable such as fodhelper.exe, eventvwr.exe, or sdclt.exe, and the system executes unauthorized code with no prompt. The key forensic clue is “manipulation of shell-related keys under the current user hive,” which is a hallmark of UAC bypass techniques that hijack file association or shell open commands so the trusted binary invokes an attacker-controlled payload instead of the intended system action. Because the modification occurs in HKCU, it can often be performed without administrator privileges, making it attractive for stealthy elevation.

The other options do not match as well. Kernel exploitation involves abusing OS kernel vulnerabilities and would not hinge on shell registry hijacks. Scheduled tasks typically leave task artifacts and are a persistence/execution method rather than this specific auto-elevate redirection behavior. DLL hijacking focuses on search-order abuse for loading malicious DLLs, not shell key redirection tied to UAC auto-elevation.