Detection of UAC Notification Suppression via Registry

Windows User Account Control (UAC) acts as a primary security barrier, requiring administrative authorization for system-level modifications. Attackers commonly attempt to bypass or suppress these prompts to execute malicious binaries or alter system configurations without triggering user alerts. By modifying the registry key 'UACDisableNotify' to a value of 1, an attacker effectively silences UAC notifications, allowing for stealthier persistence and privilege escalation. This technique is frequently observed in post-compromise activity across various malware families, including banking trojans and modular backdoors, to ensure the environment remains permissive for subsequent stages of an attack.

Impact

Successful suppression of UAC notifications reduces the likelihood of user intervention during malicious activity. This permits attackers to escalate privileges or modify sensitive system settings, such as disabling security software or establishing persistence, without alerting the local user or security administrators.

Recommendation

Deploy the provided Sigma rule to monitor for registry modifications that disable UAC security prompts. Audit administrative accounts and Group Policy Objects (GPO) to ensure that UAC notification settings cannot be altered by standard or low-privileged processes.