UAC Bypass Attempt via EnableLUA Registry Key Modification

Tim Peck@timpeck

•updated Sep 5, 2025•1•24

Detects attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This technique is used by malware like Salat Stealer to bypass security prompts and perform administrative tasks without user approval.