title: ÐÐµÑÐ¾Ð´ Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±Ñ Ð¾Ð´ Ð¼ÐµÑ Ð°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Windows
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Method of detecting attacks aimed at bypassing the User Account Control mechanism of the Windows operating system
Creators: name: Ð¡Ð°Ð¸ÑÐ¾Ð², Ð ÑÑÑÐ°Ð¼
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹
Ð¼ÐµÑ Ð°Ð½Ð¸Ð·Ð¼ Ð·Ð°ÑÐ¸ÑÑ Windows
Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
Ð¼Ð¾Ð´ÐµÐ»Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð°ÑÐ°Ðº
Ð¼ÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ
User Account Control
Windows protection mechanism
vulnerability research
attack modeling
detection method

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐµÑÐ¾Ð´ Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±ÑÐ¾Ð´ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ WindowsÂ».Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ðµ Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Windows Ð¿ÑÑÐµÐ¼ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¼ÐµÑÐ¾Ð´Ð° Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±ÑÐ¾Ð´ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¾Ð±ÑÐ¾Ð´Ð° Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ:ÐÐ·ÑÑÐµÐ½Ð¸Ðµ Ð²Ð½ÑÑÑÐµÐ½Ð½ÐµÐ³Ð¾ ÑÑÑÑÐ¾Ð¹ÑÑÐ²Ð° Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows.ÐÐ½Ð°Ð»Ð¸Ð· Ð¸Ð·Ð²ÐµÑÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows.ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ ÑÐµÑÐµÐ½Ð¸Ð¹ Ð´Ð»Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°ÑÐ°Ðº, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±ÑÐ¾Ð´ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows.Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±ÑÐ¾Ð´ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows.Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¸Ð·ÑÑÐµÐ½Ð° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐ¸ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð°. ÐÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ ÑÐµÑÐµÐ½Ð¸Ñ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÐµ Ð½Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°ÑÐ°Ðº, ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ¸ÑÑÑÑÐ¸Ñ Ð¸Ð·ÑÑÐµÐ½Ð½ÑÐµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐ¸.Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¼ÐµÑÐ¾Ð´ Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° Ð¾Ð±ÑÐ¾Ð´ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ ÐÐ¡ Windows. ÐÑÐ» ÑÐ´ÐµÐ»Ð°Ð½ Ð²ÑÐ²Ð¾Ð´, ÑÑÐ¾ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½Ð°Ñ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ Ð½Ðµ ÑÐ²Ð»ÑÐµÑÑÑ Ð² Ð´Ð¾ÑÑÐ°ÑÐ¾ÑÐ½Ð¾Ð¹ Ð¼ÐµÑÐµ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾Ð¹.ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð´Ð¾ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ð° ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ ÑÑÐµÑÐ½ÑÑ Ð·Ð°Ð¿Ð¸ÑÐµÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ Ð¸ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÑ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ ÐÐ¡ Windows.
description: The topic of the graduate qualification work is: Â«Method of detecting attacks aimed at bypassing the User Account Control (UAC) mechanism of the Windows operating systemÂ».The purpose of the study is to increase the security of the Windows operating system by developing a method for detecting attacks aimed at bypassing the User Account Control mechanism. The subject of the work is modern methods of bypassing the User Account Control mechanism. The research set the following goals:Studying the internal structure of the Windows UAC mechanism.Analyze the known UAC vulnerabilities.Research of modern solutions for detecting attacks aimed at bypassing UAC.Development of method for detecting attacks aimed at bypassing security mechanism.During the work architecture and implementation of the Windows UAC mechanism was studied. The vulnerabilities of the mechanism were analyzed. Modern security solutions aimed at detecting attacks that exploit the studied vulnerabilities were researched. As a result of the work, a method for detecting attacks aimed at bypassing the Windows UAC mechanism was developed. It was concluded that the current implementation of the UAC mechanism is not sufficiently secure.The results could be used as a base for improving UAC and designing additional Windows security modules.