Query: detection rule: Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotif
Matching passage: Sigma rule: Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotif. Logsource: windows / registry_set. Rule: title: UAC Notification Disabled id: c5f6a85d-b647-40f7-bbad-c10b66bab038 related: - id: 0d7ceeef-3539-4392-8953-3dc664912714 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system''s operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md - https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Security Center\UACDisableNotify Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for pers. Logsource: windows / process_creation. Rule: title: Uncommon Userinit Child Process id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 related: - id: 21d856f9-9281-4ded-9377-51a1a6e2a432 type: similar status: test description: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence. references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core author: Tom Ueltschi (@c_APT_ure), Tim Shelton date: 2019-01-12 modified: 2023-11-14 tags: - attack.privilege-escalation - attack.t1037.001 - attack.persistence logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_explorer: Image|endswith: :\WINDOWS\explorer.exe filter_optional_logonscripts: CommandLine|contains: - netlogon.bat - UsrLogon.cmd filter_optional_windows_core: CommandLine: PowerShell.exe filter_optional_proquota: Image|endswith: - :\Windows\System32\proquota.exe - :\Windows\SysWOW64\proquota.exe filter_optional_citrix: Image|endswith: - :\Program Files (x86)\Citrix\HDX\bin\cmstart.exe - :\Program Files (x86)\Citrix\HDX\bin\icast.exe - :\Program Files (x86)\Citrix\System32\icast.exe - :\Program Files\Citrix\HDX\bin\cmstart.exe - :\Program Files\Citrix\HDX\bin\icast.exe - :\Program Files\Citrix\System32\icast.exe filter_optional_image_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly. level: high