Hi @RFeyertag ,
Cortex XDR has many Out of the Box BIOC rules created for UAC bypass events and it generates the alerts on the same. However these rules are detection rules. In the case of the command line posted, XDR collected the event log, however, the BIOC rules designed are not in this manner and you can create a copy of the already existing BIOC rule "Tampering with the Windows User Account Controls (UAC) configuration" and tweak the rule within it with the below:
Registry [ action type = all AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA* ] AND Host [ host os = windows ]
The above rule can generate an alert for you now.
Hi @RFeyertag ,
Cortex XDR has many Out of the Box BIOC rules created for UAC bypass events and it generates the alerts on the same. However these rules are detection rules. In the case of the command line posted, XDR collected the event log, however, the BIOC rules designed are not in this manner and you can create a copy of the already existing BIOC rule "Tampering with the Windows User Account Controls (UAC) configuration" and tweak the rule within it with the below:
Registry [ action type = all AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA* ] AND Host [ host os = windows ]
The above rule can generate an alert for you now.
