Preventing UAC Bypass Techniques with CyberArk EPM

CyberArk EPM securely manages and cyclically updates local account passwords on endpoints, ensuring password management and strengthening.

Organizations effectively using CyberArk EPM’s capabilities aim to reduce malicious activities by decreasing endpoint user workload and costs while increasing hardening. It provides isolated usage with necessary privileges, preventing credential theft and attacks entirely.

The importance of endpoint user identity lies in the critical information it contains, such as names, titles, departments, usernames, emails, tokens, passwords, and biometric parameters. Every day, thousands of different credentials are used by individuals, institutions, and organizations. Cybercriminals focus on obtaining these identities through various means, with privileged identities as their main target. User identities are often the weakest link in the identity lifecycle.

Typically, identity theft attacks exploit small vulnerabilities or security gaps combined with minimal attack scenarios, leading to unauthorized access flow from unprivileged to privileged users. After gaining access to one user, attackers expand their reach, escalating privileges further. This highlights the importance of user access control (UAC) mechanisms to restrict unauthorized access and enhance computer security, which prevents identity theft and cyberattack attempts.

UAC, as part of the Windows operating system, asks for user approval for privileged operations. This includes restrictions to:

• Prevent unauthorized system changes.
• Inform users about actions.
• Enforce the least privilege principle.

These mechanisms offer advantages like user awareness, isolation, and reducing attack surfaces for end users. However, UAC alone has limitations, such as:

• Insufficient approval mechanisms.
• Inadequate boundaries in security protection.

These limitations should be supplemented, isolated, monitored, and reported. In cases beyond UAC’s scope, such as user behavior, local administrative privileges, or targeted attacks, CyberArk EPM complements UAC by providing stronger protection against malicious activities.

When used together, CyberArk EPM and UAC form a robust security layer. CyberArk EPM addresses gaps in UAC, such as managing local account passwords to remove risks from static passwords, increasing visibility and reporting to minimize risks, and providing temporary authorizations with proxy-based connections. This enhances the overall organizational system security while protecting against attacker attempts. CyberArk EPM focuses on three key areas:

Privilege Management
CyberArk EPM elevates user privileges at the task level to mitigate admin-level risks.

• Dynamic Authorization: Granting temporary admin privileges only for specific tasks.
• Automatic Authorization: Revoking admin rights immediately after task completion.
• Token-Based Authorization: Implementing privilege escalation within tokens to minimize vulnerabilities.

Application Control
CyberArk EPM monitors all endpoint applications and classifies them based on risk using AI.

• Unclassified Applications: New applications are analyzed and verified for trustworthiness.
• Trusted Sources: Applications verified by secure systems (e.g., Microsoft SCCM) are automatically trusted, including their sub-processes.

Event Monitoring
Tracking processes requiring admin rights or unclassified applications to gather insights and maintain security.

• Application Catalog: Providing visibility into all applications within the system.

• Principle of Least Privilege: Ensuring users only have the permissions necessary for their tasks, reducing the risk of malware and misconfigurations.
• Application Monitoring and Auditing: Instantly evaluating new or unknown applications using AI for risk analysis.
• Compliance Support: EPM seamlessly aligns with regulatory frameworks, such as in financial and control systems, ensuring ease of use.
• Dynamic Security Policies: Continuously applying security policies using trusted sources and inheritance mechanisms.

Attack Technique: Windows system tools (e.g., fodhelper.exe, eventvwr.exe) are automatically trusted by UAC and run with administrative privileges. Attackers exploit these tools to initiate privileged processes.

EPM Solution:

• Application Control: Verifies the digital signatures of all applications and permits only trusted sources to execute. Unclassified applications can be restricted using a “default deny” policy.
• Policy-Based Rules: Allows system tools like fodhelper.exe to run only under predefined conditions, such as by IT administrators.

How It Works:

• Registry Manipulation: An auxiliary tool with auto-elevation properties is selected.
• Command Execution: Attackers modify the registry and use the tool to execute malicious commands.

Attack Technique: Manipulating DLL files loaded by applications to inject malicious DLLs, posing severe threats to high-privilege processes.

EPM Solution:

• Trusted Source Monitoring: Ensures only digitally signed or trusted DLLs are loaded and continuously monitors loading paths.
• Inherited Trust: Automatically extends trust to all dependencies of a verified application, blocking malicious manipulations.

How It Works:

• Identifying Target DLL: Analyzing a high-privilege application’s DLL requirements.
• Creating Malicious DLL: Generating a malicious DLL that executes harmful commands.
• Replacing File: Deploying the malicious DLL in the target’s expected path.
• Executing Application: Loading the malicious DLL with elevated privileges.

Attack Technique: Exploiting registry keys controlled by UAC to run malicious commands.

EPM Solution:

• Registry Monitoring: Detects and blocks unauthorized attempts to modify registry keys.
• Dynamic Privilege Management: Temporarily grants admin rights for registry tasks and revokes them post-completion.

How It Works:

• Identifying Target Registry Key: Attackers locate registry keys linked to UAC.
• Making Modifications: Inserting malicious commands into registry paths.
• Execution: Running processes triggered by UAC with malicious registry commands.

Attack Technique: Creating a fake file mimicking a trusted Windows system file to execute malicious code.

EPM Solution:

• Application Validation: Checks the digital signature and source of all executables. Blocks unsigned or unregistered applications.
• Default Deny: Prevents the execution of unknown applications by default.

How It Works:

• Creating a Fake Application: Crafting a malicious file mimicking a system application, such as explorer.exe.
• Deploying the Fake Application: Placing the fake file in the directory of the original system application.
• Executing Commands: Running the fake application to execute malicious code with elevated privileges.

Attack Technique: Exploiting vulnerabilities in unpatched UAC components to gain elevated privileges.

EPM Solution:

• Patch Management: Ensures all system components are updated and patched, minimizing vulnerabilities.
• Dynamic Policy Enforcement: Implements policies to detect and block known exploits.