Cyritex Security Lab | Two attack methods for bypassing UAC have been updated and included in the simulation attack library!

As one of the common sub-techniques used by attackers in two tactics, namely privilege escalation and defense evasion (as shown in Figure 1), UAC bypass is heavily attempted in the early stages of various attacks.

Figure 1 ATT&CK Tactics and Techniques (Image source: https://attack.mitre.org/) If there are no sufficiently strong security policy controls or endpoint/host security product detection in the target environment, once hackers succeed, they can escalate privileges to the highest level and perform any actions they want to establish a foothold or cause damage, such as modifying the registry, executing downloaders, running scripts, executing malware, etc., laying the foundation for ultimately achieving their attack goals. Of course, as defenders, if this attack behavior of hackers can be detected or defended against at this stage, the attack chain can be blocked in the early stage of the attack, reducing the probability of successful hacker attacks. If there is a professional security operations team, they can discover and continuously monitor all subsequent attack attempts related to this attack, perform self-inspections on the preceding behaviors related to this attack, proactively clean up all discovered entry points or footholds, and ultimately achieve active defense.

▌UAC Introduction

User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware by using pop-ups to further ask users to confirm whether to authorize the current executable file to block malicious programs. If the user is a standard user, Windows assigns them a standard Access Token; if the user logs in with administrator privileges, two Access Tokens are generated. One is a full administrator Access Token (referred to as: full access token), and the other is a standard user Access Token. Under normal circumstances, the Explore.exe process is started with standard user privileges. If the user agrees, they are granted the full administrator access token to perform operations.

Figure 2 UAC Architecture To learn more details, please visit the following link: https://docs.microsoft.com/zh-cn/windows/security/identity-protection/user-account-control/how-user-account-control-works

▌Simulated Attack Library Update

You can already select verification actions related to UAC bypass on our platform for attack simulation to test the detection and defense capabilities of your endpoint/host defense measures against these types of attack techniques.

In particular, you can realistically execute ransomware through simulated validation's protected sandbox to ensure whether your current endpoint/host defense measures can defend against its attack at the last second, without worrying about the various impacts of its destructiveness if it is not defended against. Simulated validation's protected sandbox will ensure its security without causing any impact.