TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

Why You Really Need to Stop Disabling UAC

Kassie Kimball · 2022-09-28 · Read original ↗

ATT&CK techniques detected

5 predictions
T1548.002Bypass User Account Control
99%
“why you really need to stop disabling uac why you really need to stop disabling uac noah heckman / / windows vista didn ’ t have many fans in the windows community ( to put it lightly ). it beaconed in a new user interface, file structure, and a bunch of darn popups asking if you…”
T1548.002Bypass User Account Control
98%
“as soon as you log in. it checks if your account is an admin on the system, and if it is, then the uac subroutine effectively splits the account into a high privilege and low privilege account. it locks admin operations behind an admin token, which then will prompt you for approv…”
T1548.002Bypass User Account Control
97%
“in the windows secured desktop environment. when this happens, only certain processes can interact with it. specifically, the logged - in user ’ s explorer. exe process. so, in general, no, there is not a way for the malware to just “ click yes. ” of course, there is a slew of ua…”
T1204.002Malicious File
81%
“attachment. office applications and other windows processes look for this “ mark ” and will restrict certain actions based on it until you approve it. this is why when you open an excel document with macros on the internal share, it doesn ’ t prompt you to “ enable editing ” and …”
T1548.002Bypass User Account Control
32%
“but that we are using them to our advantage. disabling macros from documents downloaded from the internet is a great start. ensure windows smartscreen is enabled on the system. for bonus points, consider preventing your end users from being able to bypass it with the “ run anyway…”

Summary

Noah Heckman // Windows Vista didn’t have many fans in the Windows community (to put it lightly). It beaconed in a new user interface, file structure, and a bunch of […]

The post Why You Really Need to Stop Disabling UAC appeared first on Black Hills Information Security, Inc..