mandiant / mandiant/flare-vm

Configuration: UAC promp only pop up

Open
#511 1 comment 0 reactions 0 assignees View on GitHub
:gem: enhancement :grey_question: discussion
Dominant language
PowerShell
Stars
9.1k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Details

The UAC promp is annoying/time consuming as we need to launch many of our tools in admin mode. Disabling it has the issue that we won't notice that malware want to get admin priviledges by UAC when launching it. I have heard there is a setting to stop it from darkening the screen and show the pop up, that may be a good solution for both cases. Alternatively we could just disable UAC promp only for apps like procmon (only if the other option is not possible).

Requires https://github.com/mandiant/flare-vm/issues/510

Contributor guide

Open the contributing guide

Research direction

Start by resolving the required work in issue 510, then inspect the repository's PowerShell setup scripts for where Windows UAC behavior is configured. Determine whether UAC can stop darkening the screen while retaining prompts, or whether a narrower treatment for tools such as Procmon is needed. Done means the chosen behavior is applied during setup without disabling malware-related UAC visibility.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
devops, operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.