Is your UAC set properly?

๐——๐—ฒ๐—ณ๐—ฎ๐˜‚๐—น๐˜ โ†’ ๐—›๐—ฎ๐—ฟ๐—ฑ๐—ฒ๐—ป๐—ฒ๐—ฑ

Real configs. Real fixes. Windows & AD security.

๐—ค๐˜‚๐—ถ๐—ฐ๐—ธ ๐˜๐—ฒ๐˜€๐˜: press Win + R โ†’ type msconfig.exe โ†’ Enter.

Did the console open immediately? If yes, your ๐—จ๐—”๐—– ๐—ถ๐˜€๐—ปโ€™๐˜ ๐—ต๐—ฎ๐—ฟ๐—ฑ๐—ฒ๐—ป๐—ฒ๐—ฑ.

๐Ÿงจย ๐—•๐˜† ๐—ฑ๐—ฒ๐—ณ๐—ฎ๐˜‚๐—น๐˜, UAC has exceptions for Windows binaries (Prompt for consent for non-Windows binaries)โ€”attackers can abuse this behavior with known ๐—จ๐—”๐—– ๐—ฏ๐˜†๐—ฝ๐—ฎ๐˜€๐˜€๐—ฒ๐˜€.

โœ… ๐—›๐—ฎ๐—ฟ๐—ฑ๐—ฒ๐—ป ๐—ถ๐˜โ€”configure following:

๐˜œ๐˜ด๐˜ฆ๐˜ณ ๐˜ˆ๐˜ค๐˜ค๐˜ฐ๐˜ถ๐˜ฏ๐˜ต ๐˜Š๐˜ฐ๐˜ฏ๐˜ต๐˜ณ๐˜ฐ๐˜ญ: ๐˜‰๐˜ฆ๐˜ฉ๐˜ข๐˜ท๐˜ช๐˜ฐ๐˜ณ ๐˜ฐ๐˜ง ๐˜ต๐˜ฉ๐˜ฆ ๐˜ฆ๐˜ญ๐˜ฆ๐˜ท๐˜ข๐˜ต๐˜ช๐˜ฐ๐˜ฏ ๐˜ฑ๐˜ณ๐˜ฐ๐˜ฎ๐˜ฑ๐˜ต ๐˜ง๐˜ฐ๐˜ณ ๐˜ข๐˜ฅ๐˜ฎ๐˜ช๐˜ฏ๐˜ช๐˜ด๐˜ต๐˜ณ๐˜ข๐˜ต๐˜ฐ๐˜ณ๐˜ด ๐˜ช๐˜ฏ ๐˜ˆ๐˜ฅ๐˜ฎ๐˜ช๐˜ฏ ๐˜ˆ๐˜ฑ๐˜ฑ๐˜ณ๐˜ฐ๐˜ท๐˜ข๐˜ญ ๐˜”๐˜ฐ๐˜ฅ๐˜ฆ

โžก๏ธ ๐˜—๐˜ณ๐˜ฐ๐˜ฎ๐˜ฑ๐˜ต ๐˜ง๐˜ฐ๐˜ณ ๐˜ค๐˜ณ๐˜ฆ๐˜ฅ๐˜ฆ๐˜ฏ๐˜ต๐˜ช๐˜ข๐˜ญ๐˜ด (๐˜ฐ๐˜ณ ๐˜ค๐˜ฐ๐˜ฏ๐˜ด๐˜ฆ๐˜ฏ๐˜ต) ๐˜ฐ๐˜ฏ ๐˜ต๐˜ฉ๐˜ฆ ๐˜ด๐˜ฆ๐˜ค๐˜ถ๐˜ณ๐˜ฆ ๐˜ฅ๐˜ฆ๐˜ด๐˜ฌ๐˜ต๐˜ฐ๐˜ฑ

(this is also included in many ๐—ฆ๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐—•๐—ฎ๐˜€๐—ฒ๐—น๐—ถ๐—ป๐—ฒ๐˜€ that replace insecure defaults)

After the hardening youโ€™ll see a ๐—จ๐—”๐—– ๐—ฝ๐—ฟ๐—ผ๐—บ๐—ฝ๐˜ ๐—ณ๐—ถ๐—ฟ๐˜€๐˜; only after confirming (or entering credentials) will the console open.

๐Ÿงช Simple to test. Simple to implement.

If you want to stand out and harden your environment properly, ๐—ฐ๐—ต๐—ฒ๐—ฐ๐—ธ ๐—ผ๐˜‚๐˜ ๐—บ๐˜† ๐—ฐ๐—ผ๐˜‚๐—ฟ๐˜€๐—ฒ๐˜€.

https://horizon-secured.com/courses/

๐™‡๐™š๐™–๐™ง๐™ฃ โ€ข ๐˜ฝ๐™ช๐™ž๐™ก๐™™ โ€ข ๐˜ฟ๐™š๐™›๐™š๐™ฃ๐™™