Detection rules › Splunk
ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. This use case detects registry modification events or process executions with registry modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control |
References
- https://attack.mitre.org/techniques/T1548/002/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-22---disable-uac-admin-consent-prompt-via-consentpromptbehavioradmin-registry-key
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
Rule body yaml
id: '31193.55842'
title: ConsentPromptBehaviorAdmin Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
on system. Windows User Account Control (UAC) allows a program to elevate its privileges
(tracked as integrity levels ranging from low to high) to perform a task under administrator-level
permissions, possibly by prompting the user for confirmation. The impact to the
user ranges from denying the operation under high enforcement to allowing the user
to perform the action if they are in the local administrators group and click through
the prompt or allowing them to enter an administrator password to complete the action.
This use case detects registry modification events or process executions with registry
modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin.
-- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<")
"Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=13) OR "<EventID>13<"))
"ConsentPromptBehaviorAdmin" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| table _time, host, user, process, parent_process_name, signature_id, process_name
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-22---disable-uac-admin-consent-prompt-via-consentpromptbehavioradmin-registry-key
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<") "Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=13) OR "<EventID>13<")) "ConsentPromptBehaviorAdmin" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
Stage 2: table
| table _time, host, user, process, parent_process_name, signature_id, process_name
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "Set-ItemProperty" |
| 1 | "sp " |
| 1 | "ADD" |
| 1 | TERM |
| 1 | "<EventID>13<" |
| 1 | "ConsentPromptBehaviorAdmin" |
| 1 | "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" |