Disable UAC via EnableLUA Registry Modification

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to disable User Account Control (UAC) by modifying the EnableLUA registry key. Disabling UAC lowers system security by allowing processes to run with elevated privileges without user consent. Adversaries may disable UAC to escalate privileges or execute malicious code without triggering security prompts, making detection and containment more difficult.

2025-03-03 00:00:00

None

6fc1de62-618a-4f5c-95e0-0409152fd68b

attack.defense-evasion attack.privilege-escalation attack.t1548.002

Nextron Sigma feed only (private)