User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)

Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Application Shimming - T1546.011 (42fe883a-21ea-4cfb-b94a-78b6476dcc83)	Attack Pattern	User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	1
Services File Permissions Weakness - T1574.010 (9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd)	Attack Pattern	User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	1
User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	1
User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	1
Executable Installer File Permissions Weakness - T1574.005 (70d81154-b187-45f9-8ec5-295d01255979)	Attack Pattern	User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	1
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073)	Attack Pattern	User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	1
User Account Control - M1052 (2c2ad92a-d710-41ab-a996-1db143bb4808)	Course of Action	Pass the Hash - T1550.002 (e624264c-033a-424d-9fd7-fc9c3bbdb03e)	Attack Pattern	1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db)	Attack Pattern	Application Shimming - T1546.011 (42fe883a-21ea-4cfb-b94a-78b6476dcc83)	Attack Pattern	2
Services File Permissions Weakness - T1574.010 (9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd)	Attack Pattern	Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	2
Executable Installer File Permissions Weakness - T1574.005 (70d81154-b187-45f9-8ec5-295d01255979)	Attack Pattern	Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	2
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073)	Attack Pattern	Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	2
Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814)	Attack Pattern	Pass the Hash - T1550.002 (e624264c-033a-424d-9fd7-fc9c3bbdb03e)	Attack Pattern	2