Detection rules › Splunk
PromptOnSecureDesktop Registry Value Modified (Windows Event Log)
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. This use case detects registry modification events or process executions with registry modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control |
References
- https://attack.mitre.org/techniques/T1548/002/
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4657 | A registry value was modified. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '31190.55836'
title: PromptOnSecureDesktop Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
on system. Windows User Account Control (UAC) allows a program to elevate its privileges
(tracked as integrity levels ranging from low to high) to perform a task under administrator-level
permissions, possibly by prompting the user for confirmation. The impact to the
user ranges from denying the operation under high enforcement to allowing the user
to perform the action if they are in the local administrators group and click through
the prompt or allowing them to enter an administrator password to complete the action.
This use case detects registry modification events or process executions with registry
modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop.
-- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
"<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
"ADD" OR "Set-ItemProperty" OR "sp ")) "PromptOnSecureDesktop" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| table _time, host, user, process, parent_process_name, signature_id, process_name
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Process command-line parameters
- Windows event logs
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "ADD" OR "Set-ItemProperty" OR "sp ")) "PromptOnSecureDesktop" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
Stage 2: table
| table _time, host, user, process, parent_process_name, signature_id, process_name
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4657<" |
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "ADD" |
| 1 | "Set-ItemProperty" |
| 1 | "sp " |
| 1 | "PromptOnSecureDesktop" |
| 1 | "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" |