skills/mukul975/anthropic-cybersecurity-skills/detecting-t1548-abuse-elevation-control-mechanism/Gen Agent Trust Hub
detecting-t1548-abuse-elevation-control-mechanism
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements benign threat-hunting workflows to identify privilege escalation and elevation control abuse (MITRE ATT&CK T1548). The script uses local process execution via
subprocess.check_outputto query the Windows Registry, inspect Sysmon logs via PowerShell, list SUID files, and check sudo configurations. All parameters are statically configured or properly constrained, presenting no risk of command injection or malicious execution.
Audit Metadata