There's no way that second use case doesn't show a UAC prompt. The whole point of the split token / UAC elevation is to avoid elevation without user interactio

There's no way that second use case doesn't show a UAC prompt. The whole point of the split token / UAC elevation is to avoid elevation without user interaction. Imagine malware stuck as standard user just running itself like: cmd.exe /c sudo malware.exe