PowerShell/Registry Modification Disabling UAC (ConsentPromptBehaviorAdmin/EnableLUA)
Detects modifications to Windows Registry keys responsible for UAC behavior (ConsentPromptBehaviorAdmin and EnableLUA) performed by common command-line utilities. Such modifications can be indicative of attempts to disable or weaken User Account Control (UAC) to facilitate privilege escalation or defense evasion.
Cortex XDR
