Elastic Defend high stable eql

User Account Control Disabled via Registry

Identifies attempts to disable Users Account Control via registry modification. Malware may disable UAC to run with high integrity.

View Source

Detection Logic

registry where not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA" and
 registry.data.strings : "0" and
 (process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.name : ("msiexec.exe", "rundll32.exe", "wscript.exe", "cscript.exe"))

Field Validations

Loading…

Comments (0)

Loading comments...