The other coments forget something. An attacker can elevate from an unprivileged context (No administrator rights) into a privileged context (admin rights) if it runs into an account which is actually from an administrator. This is called an UAC Bypass.
The Attack
As you may be expecting, this attack involves code injection techniques, such as AtomBombombing (but in fact any other method, even the simple CreateRemoteThread will work).
This is done in 2 steps. The first thing to do is, effectively, inject code into certain processes that run in user mode. There are a few vulnerable processes but I'll be talking about explorer.exe
which is also the most stable. This process is not like others, it is special since it has a lot of uses. That's why it has some special privileges. For example, the COM IFileOperation interface can be elevated; This means it will run with some kind of admin-like privileges. This may look useless, since you can only write files with admin rights. But it isn't! Since you can use that to perform another attack; DLL Hijacking. This is step 2. Basically you would place your evil.dll
, which may be embebed in the evil.exe
, into the same place where autoelevated processes are; Autoelevated programs or processes are programs that once executed will automatically get admin rights. Shortly, this is done by Microsoft since those programs must have those privileges to run correctly and perform things like automated tasks. Finally, we would execute that program, which will load the evil.dll
and then auto elevate, therefore granting admin privileges to the attacker code.
Mitigation
Microsoft tried to patch the second step in the past, by whitelisting .dll files and similar techniques, but they failed, since we can easily bypass that just by replacing existing .dll files in some cases.
The first step is not going to be patched at all. Microsoft hasn't patched other injection methods like CreateRemoteThread, why would them patch Atombombing? That would require a huge effort and heavy modification of the OS, which is likely not going to happen. The only way to prevent that would be deleting those special rights from programs like the explorer but it seems like that's not going to happen neither. So basically it depends on AVs to detect if malicious programs will try to inject code using any method.
You can see a POC of the exploit above here
EDIT: I forgot some points of the question. So, this are the technical ways to prevent atombombing from having success:
-API hooking: An antivirus solution may intercept and scan all attempts to modify the atom table. The functions GlobalAddAtom() and GlobalGetAtomName() are the ones used to perform this attack. They could intercept the calls and scan the data that is going to be added to the Atom table, searching for key words or more likely, trying to analize the data, if it's a shellcode.
malicious.exe
, your machine might well not be your machine anymore.