Modification of UAC EnableLUA Registry Key

Disabling User Account Control (UAC) is a common post-exploitation technique used by attackers to weaken the security posture of a Windows host. By setting the EnableLUA registry key to 0, an attacker can prevent the system from prompting for administrative consent, effectively allowing malicious processes to run with elevated privileges without standard user interaction. This configuration change requires administrative access initially, meaning it is typically performed as a persistence or privilege escalation maintenance step rather than an initial entry vector. Detection of this activity is critical, as it serves as a high-fidelity indicator of an adversary attempting to modify host security settings to facilitate further malicious actions.

Impact

Successful modification of the EnableLUA registry key results in the complete deactivation of UAC prompts for administrative tasks. This increases the susceptibility of the endpoint to privilege escalation, as malware can execute elevated commands silently. If the attacker maintains administrative persistence, this change ensures that subsequent malicious activities encounter no further user-interface hurdles, significantly increasing the probability of full system compromise and credential harvesting.

Recommendation

Deploy the provided Sigma rule to monitor for registry modifications targeting the EnableLUA system policy. Analysts should investigate any unauthorized process initiating a write request to this registry hive, particularly if the process is not a recognized system management or group policy update utility.

• Enable registry auditing on the path HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System to capture successful set operations.
• Integrate the Sigma rule below into the SIEM to alert on immediate changes to the EnableLUA value.
• Review administrative privileges on affected endpoints to ensure that only authorized accounts can modify system policy registry keys.