heroui logo

UAC Notification Disabled

Sigma Rules

View Source
Summary
This detection rule identifies potential attempts by attackers to disable User Account Control (UAC) notifications on a Windows machine. UAC is an essential security feature designed to prevent unauthorized changes to the operating system. Under normal operation, UAC prompts the user for permission or an administrator password whenever an application attempts to make changes that could affect the system's operation. By setting the registry value 'UACDisableNotify' to 1, these prompts are suppressed, which can allow malicious software to operate without user consent or knowledge. The rule monitors the Windows registry for changes to the specified key, which indicates a potential security breach when the value is altered.
Categories
  • Windows
  • Endpoint
  • Infrastructure
Data Sources
  • Windows Registry
ATT&CK Techniques
  • T1548.002
Created: 2024-05-10