topic Re: Deactivating UAC should be alerted in Cortex XDR Discussions

Deactivating UAC should be alerted

RFeyertag — Sat, 27 Aug 2022 21:57:51 GMT

Hello dear community,

I tested to deactivate my UAC, which was possible without any alert.

In my opinion there should be an alert triggerd. What do you think?

https://twitter.com/Computeus7/status/1562497080048119808

Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t "REG_DWORD" /d "0" /f

Rob

Re: Deactivating UAC should be alerted

neelrohit — Sun, 28 Aug 2022 01:51:31 GMT

Hi @RFeyertag ,

Cortex XDR has many Out of the Box BIOC rules created for UAC bypass events and it generates the alerts on the same. However these rules are detection rules. In the case of the command line posted, XDR collected the event log, however, the BIOC rules designed are not in this manner and you can create a copy of the already existing BIOC rule "Tampering with the Windows User Account Controls (UAC) configuration" and tweak the rule within it with the below:

Registry [ action type = all AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA* ] AND Host [ host os = windows ]

The above rule can generate an alert for you now.

Re: Deactivating UAC should be alerted

RFeyertag — Mon, 29 Aug 2022 13:01:43 GMT

Hey Neelrohit,

thank you, I will tweak the BIOCs as you mentioned.

Rob