User Account Control
Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access.
Techniques Addressed by Mitigation
Changing UAC settings to "Always Notify" will give the user more visibility when UAC elevation is requested, however, this option will not be popular among users due to the constant UAC interruptions.
|Enterprise||T1088||Bypass User Account Control||
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking.
|Enterprise||T1044||File System Permissions Weakness||
Turn off UAC's privilege elevation for standard users
|Enterprise||T1075||Pass the Hash||
Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon. The associated Registry key is located
Ensure that all private keys are stored securely in locations where only the legitimate owner has access to with strong passwords and are rotated frequently.
Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary.