UAC bypass silentcleanup

schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

UAC bypass abusing the SilentCleanup scheduled task: it runs elevated and inherits the environment, where the COMSPEC variable or the cleanup application registry has been hijacked.

When fodhelper/eventvwr are already signed by the EDR and you need a different variant. SilentCleanup is a Microsoft task that self-elevates; by previously modifying the registry (HKCU Environment or the task key) you can make it execute your payload with an elevated token.

If the SilentCleanup task is disabled by GPO or the EDR monitors environment variable modifications (HKCU\Environment). It is a more complex technique to set up: requires preparing the registry before launching the task.