detect-uac-elevation

This query identifies UAC elevated processes by analyzing launches of consent.exe (the process that performs UAC elevation). The first parameter of consent.exe is the process ID being elevated, therefore we extract this value and use a combination of that ID and the DeviceId to join it with processes that ran UAC elevated on the device. Given that process IDs can be reused, a time filter is performed to ensure that the elevation request and the process launch occur within a specified period of time (as written 30 minutes).