Disable UAC
Hypothesis and description
Threat actors often, after compromising a machine, try to disable User Access Control (UAC) to escalate privileges. This is often done by changing the registry key for system policies using “reg.exe”, a legitimate tool provided by Microsoft for modifying the registry via command prompt or scripts. This action interferes with UAC and may enable a threat actor to escalate privileges on the compromised system, thereby allowing further exploitation of the system.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2020-12-11
- Contributors
- Cyware Labs
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1548 Abuse Elevation Control MechanismT1548.002 | Privilege Escalation | Medium |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
This query looks for the specific use of reg.exe in correlation to commands aimed at disabling UAC.
processes = search Process:Create
cmd_processes = filter processes where (
(parent_image = "C:\\Windows\\System32\\cmd.exe") AND (command_line = "reg.exe%HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System%REG_DWORD /d 0%")
)This query looks for the specific use of reg.exe in correlation to commands aimed at disabling UAC.
sourcetype = __your_sysmon_index__ ParentImage = "C:\\Windows\\System32\\cmd.exe" | where like(CommandLine,"reg.exe%HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System%REG_DWORD /d 0%")Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ALAccount Locking1 shared
- D3-AAAgent Authentication1 shared
- D3-RUAARestore User Account Access1 shared
- D3-ULAUnlock Account1 shared
- D3-UAPUser Account Permissions1 shared
- D3-CDPChange Default Password1 shared
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-AMAccess Modeling1 shared