User Account Control Disabled via Registry

[rule]
description = """
Identifies attempts to disable Users Account Control via registry modification. Malware may disable UAC to run with high
integrity.
"""
id = "00976339-61b4-4108-98e5-da0b19b0c680"
license = "Elastic License v2"
name = "User Account Control Disabled via Registry"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua",
]
version = "1.0.6"

query = '''
registry where not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA" and
 registry.data.strings : "0" and
 (process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.name : ("msiexec.exe", "rundll32.exe", "wscript.exe", "cscript.exe"))
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.002"
name = "Bypass User Account Control"
reference = "https://attack.mitre.org/techniques/T1548/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.1.0"