I got the same question too.
end-users won't right-click and run malware with elevate admin I guess? but if the sample have UAC bypass exploit, it makes sense.
I'm puzzled why BYOVD is a thing anywhere besides home users. Loading a driver needs admin perms. Why does the end user have that? twitter.com/mstoned7/statu…
