Deactivating UAC should be alerted

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Deactivating UAC should be alerted

L4 Transporter

Hello dear community, 

 

I tested to deactivate my UAC, which was possible without any alert. 

In my opinion there should be an alert triggerd. What do you think? 

 

https://twitter.com/Computeus7/status/1562497080048119808

Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t "REG_DWORD" /d "0" /f

 

BR

 

Rob

 

1 accepted solution

Accepted Solutions

L5 Sessionator

Hi @RFeyertag ,

 

Cortex XDR has many Out of the Box BIOC rules created for UAC bypass events and it generates the alerts on the same. However these rules are detection rules. In the case of the command line posted, XDR collected the event log, however, the BIOC rules designed are not in this manner and you can create a copy of the already existing BIOC rule "Tampering with the Windows User Account Controls (UAC) configuration" and tweak the rule within it with the below:

 

Registry [ action type = all AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA* ] AND Host [ host os = windows ]

 

The above rule can generate an alert for you now.

Screenshot 2022-08-28 at 9.51.08 AM.png

View solution in original post

2 REPLIES 2

L5 Sessionator

Hi @RFeyertag ,

 

Cortex XDR has many Out of the Box BIOC rules created for UAC bypass events and it generates the alerts on the same. However these rules are detection rules. In the case of the command line posted, XDR collected the event log, however, the BIOC rules designed are not in this manner and you can create a copy of the already existing BIOC rule "Tampering with the Windows User Account Controls (UAC) configuration" and tweak the rule within it with the below:

 

Registry [ action type = all AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA* ] AND Host [ host os = windows ]

 

The above rule can generate an alert for you now.

Screenshot 2022-08-28 at 9.51.08 AM.png

L4 Transporter

Hey Neelrohit, 

 

thank you, I will tweak the BIOCs as you mentioned.

 

BR

 

Rob

  • 1 accepted solution
  • 1617 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!