Windows registry artifactUser Account Control (UAC)
Run all administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Enabled (UAC On)
- Threat Hunting
- 10 keys
SOFTWARE
Registry keys
10 keys that RECmd reads for this artifact
SOFTWAREEnableLUAMicrosoft\Windows\CurrentVersion\Policies\SystemRun all administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Enabled (UAC On)
SOFTWAREConsentPromptBehaviorAdminMicrosoft\Windows\CurrentVersion\Policies\SystemBehavior of the elevation prompt for administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Prompt for credentials (Secure Desktop), 2 = Prompt for Consent Yes No (Secure Desktop), 3 = Prompt for credentials (Secure Desktop Off), 4 = Prompt for Consent Yes No (Secure Desktop Off), 5 = Prompt for Non-Windows Binaries (Default)
SOFTWAREConsentPromptBehaviorUserMicrosoft\Windows\CurrentVersion\Policies\SystemBehavior of the elevation prompt for standard users, 0 = Deny Elevation Requests, 1 = Prompt for credentials (Secure Desktop - Default), 3 = Prompt for credentials (Secure Desktop Off)
SOFTWAREFilterAdministratorTokenMicrosoft\Windows\CurrentVersion\Policies\SystemUse Admin Approval Mode for the built-in Administrator account, 0 = Disabled (UAC Off - Default), 1 = Enabled (UAC On)
SOFTWAREEnableUIADesktopToggleMicrosoft\Windows\CurrentVersion\Policies\SystemAllow UIAccess applications to prompt for elevation without using the secure desktop, 0 = Disabled (Secure Desktop On - Default), 1 = Enabled (Secure Desktop Off)
SOFTWAREEnableInstallerDetectionMicrosoft\Windows\CurrentVersion\Policies\SystemDetect application installations and prompt for elevation, 0 = Disabled (No Prompt), 1 = Enabled (Prompt)
SOFTWAREValidateAdminCodeSignaturesMicrosoft\Windows\CurrentVersion\Policies\SystemOnly elevate executable files that are signed and validated, 0 = Disabled (Default), 1 = Enabled (Force PKI certification path validation)
SOFTWAREEnableSecureUIAPathsMicrosoft\Windows\CurrentVersion\Policies\SystemOnly elevate UIAccess applications that are installed in secure locations, 0 = Disabled (User Interface Accessibility Integrity Level in Insecure Locations Allowed), 1 = Enabled (Default)
SOFTWAREPromptOnSecureDesktopMicrosoft\Windows\CurrentVersion\Policies\SystemSwitch to the secure desktop when prompting for elevation, 0 = Disabled (Secure Desktop Off), 1 = Enabled (Default)
SOFTWAREEnableVirtualizationMicrosoft\Windows\CurrentVersion\Policies\SystemVirtualize file and registry write failures to per-user locations, 0 = Disabled (Fail to Write Data), 1 = Enabled (Default)
References
12 links
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/958053ae-5397-4f96-977f-b7700ee461ec(opens in new tab)
- learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua(opens in new tab)
- github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4(opens in new tab)
- github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/15f4f7b3-d966-4ff4-8393-cb22ea1c3a63(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/7c705718-f58e-4886-8057-37c8fd9aede1(opens in new tab)
- learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration?tabs=intune(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/c2b4efc5-2fe8-4dc9-95f7-2417b3d4cc6d(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/a9b816e0-075b-4674-a1a9-cecd1d9523e7(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/9ad50fd3-4d8d-4870-9f5b-978ce292b9d8(opens in new tab)
- learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/932a34b5-48e7-44c0-b6d2-a57aadef1799(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)