EnableLUA Registry Value Modified (PowerShell)

id: '31087.55689'
title: EnableLUA Registry Value Modified
description: Adversaries may bypass UAC mechanisms to elevate process privileges on
  system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. This use case detects
  registry modification events or process executions with registry modification commands
  targeting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("Set-Item-Property"
  OR "sp " OR "ADD") "EnableLUA" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user user, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1548/002/