Modification of UAC Secure Desktop Prompt Registry Setting

This threat involves the modification of the Windows registry key 'PromptOnSecureDesktop' under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. The secure desktop is an isolated environment designed to prevent malicious software from intercepting or tampering with User Account Control (UAC) elevation prompts. By changing this registry value to 0, an attacker forces UAC prompts to appear on the user's primary desktop. This configuration change is often associated with privilege escalation efforts, as it potentially exposes the elevation interface to UI automation, screen scraping, or click-jacking techniques that would otherwise be blocked by the isolated secure desktop environment. Defenders should monitor registry modifications targeting this path to detect attempts to weaken Windows system security controls.

Impact

Disabling the UAC secure desktop prompt lowers the defensive posture of the host operating system. If successful, this creates an environment where malicious software can interact with or manipulate elevation requests, potentially facilitating unauthorized privilege escalation or bypassing security warnings. This technique is frequently used as a precursor to more sophisticated attacks that require persistent or elevated access.

Recommendation

Deploy the provided Sigma rule to monitor for registry modifications to the 'PromptOnSecureDesktop' value. Establish an alert baseline for any account, especially non-administrative accounts, that initiates changes to 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. Use the telemetry captured to identify the parent process responsible for the registry change, as this is likely the primary indicator of an ongoing compromise or unauthorized configuration change.