Configuration: UAC promp only pop up
- Dominant language
- PowerShell
- Stars
- 9.1k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
### Details
The UAC promp is annoying/time consuming as we need to launch many of our tools in admin mode. Disabling it has the issue that we won't notice that malware want to get admin priviledges by UAC when launching it. I have heard there is a setting to stop it from darkening the screen and show the pop up, that may be a good solution for both cases. Alternatively we could just disable UAC promp only for apps like procmon (only if the other option is not possible).
Requires https://github.com/mandiant/flare-vm/issues/510
Contributor guide
Research direction
Start by resolving the required work in issue 510, then inspect the repository's PowerShell setup scripts for where Windows UAC behavior is configured. Determine whether UAC can stop darkening the screen while retaining prompts, or whether a narrower treatment for tools such as Procmon is needed. Done means the chosen behavior is applied during setup without disabling malware-related UAC visibility.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- devops, operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100