The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC).
- Type: TTP
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2020-11-18
- Author: David Dorsey, Patrick Bareiss, Splunk
- ID: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
Kill Chain Phase
- Actions on Objectives
- CIS 8
1 2 3 4 | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`
The SPL above uses the following Macros:
Note that disabling_remote_user_account_control_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
How To Implement
To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.
Known False Positives
This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence.
Associated Analytic story
- Windows Defense Evasion Tactics
- Suspicious Windows Registry Activities
- Windows Registry Abuse
|42.0||70||60||The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.|
source | version: 4