{"id":20,"title":"User Account Control (UAC) G\u00fcvenlik A\u00e7\u0131\u011f\u0131 (Misconfiguration)","content":"

 <\/p>\n

User Account Control (UAC) Güvenlik Aç\u0131\u011f\u0131: Secure Desktop ile Privilege Escalation Korumas\u0131<\/h1>\n

User Account Control (UAC), Windows i\u015fletim sistemlerinin en kritik güvenlik mekanizmalar\u0131ndan biridir. UAC'nin secure desktop üzerinde yönetici onay\u0131 isteyecek \u015fekilde yap\u0131land\u0131r\u0131lmamas\u0131, malicious software'in fark edilmeden yüksek yetkilerle çal\u0131\u015fmas\u0131na olanak tan\u0131r.<\/p>\n

Admin Approval Mode ile birlikte do\u011fru yap\u0131land\u0131r\u0131lan UAC, privilege escalation sald\u0131r\u0131lar\u0131na kar\u015f\u0131 güçlü bir savunma olu\u015fturur. Bu yaz\u0131da, UAC güvenlik aç\u0131\u011f\u0131n\u0131 ve “Prompt for consent on the secure desktop”<\/strong> yap\u0131land\u0131rmas\u0131n\u0131n önemini detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n

\n

User Account Control (UAC) Architecture<\/h2>\n

UAC Security Model<\/h3>\n

Core Components<\/h4>\n
UAC Security Stack:\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Application Request                 \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Admin Approval Mode                 \u2502 ← Critical Security Layer\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Secure Desktop                      \u2502 ← Isolation Mechanism\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Elevation Prompt                    \u2502 ← User Interaction\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Privilege Token Management          \u2502 ← Permission Granting\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n
\n
Token Architecture<\/h3>\n
# UAC token structure\nfunction Analyze-UACTokens {\n\n    $tokenInfo = @{\n        \"Standard_User_Token\" = @{\n            Description = \"Limited privileges for daily operations\"\n            Capabilities = @(\n                \"File access\",\n                \"Registry read\",\n                \"Network access\"\n            )\n            Restrictions = @(\n                \"No system modification\",\n                \"No driver installation\",\n                \"No security policy changes\"\n            )\n        }\n\n        \"Administrator_Token\" = @{\n            Description = \"Full administrative privileges\"\n            Capabilities = @(\n                \"System modification\",\n                \"Driver installation\",\n                \"Security policy changes\",\n                \"Service management\"\n            )\n            Requirements = @(\n                \"UAC elevation\",\n                \"User consent\",\n                \"Secure desktop prompt\"\n            )\n        }\n\n        \"Filtered_Admin_Token\" = @{\n            Description = \"Admin user running with standard privileges\"\n            Elevation_Process = \"UAC prompt → Secure desktop → User consent → Full admin token\"\n        }\n    }\n\n    return $tokenInfo\n}\n<\/code><\/pre>\n
\n
Admin Approval Mode Mechanics<\/h2>\n
Normal vs Admin Approval Mode<\/h3>\n\n\n\n\n\n\n\n
Mode<\/th>\nToken Type<\/th>\nPrivilege Level<\/th>\nUAC Behavior<\/th>\n<\/tr>\n<\/thead>\n
Normal Admin<\/td>\nFull Admin Token<\/td>\nHigh<\/td>\n\u274c No prompts – Security risk<\/td>\n<\/tr>\n
Admin Approval Mode<\/td>\nFiltered Token → Full Token<\/td>\nStandard → High<\/td>\n\u2705 UAC prompts required<\/td>\n<\/tr>\n
Standard User<\/td>\nStandard Token<\/td>\nLimited<\/td>\n\u2705 Credential prompt required<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n
Güvenlik Riskleri ve Sald\u0131r\u0131 Vektörleri<\/h2>\n
1. Malicious Software Privilege Escalation<\/h3>\n
Silent Elevation Attacks<\/h4>\n
# UAC bypass simulation scenarios\nfunction Simulate-UACBypassRisks {\n    param($UACLevel)\n\n    $riskScenarios = @{\n        \"Never_Notify\" = @{\n            RiskLevel = \"CRITICAL\"\n            AttackSuccess = \"99%\"\n            Description = \"Malware gains admin privileges silently\"\n            Examples = @(\n                \"Rootkit installation without detection\",\n                \"System file modification\",\n                \"Registry security policy changes\",\n                \"Service hijacking and persistence\"\n            )\n        }\n\n        \"Prompt_Without_Secure_Desktop\" = @{\n            RiskLevel = \"HIGH\"\n            AttackSuccess = \"75%\"\n            Description = \"UI automation attacks can bypass prompts\"\n            Examples = @(\n                \"Automated clicking of UAC dialogs\",\n                \"DLL injection into UAC prompt process\",\n                \"Window message spoofing\",\n                \"Focus stealing attacks\"\n            )\n        }\n\n        \"Prompt_On_Secure_Desktop\" = @{\n            RiskLevel = \"LOW\"\n            AttackSuccess = \"15%\"\n            Description = \"Secure desktop isolation prevents most bypasses\"\n            Examples = @(\n                \"Physical access required for bypass\",\n                \"Kernel-level exploits needed\",\n                \"Very limited attack surface\"\n            )\n        }\n    }\n\n    return $riskScenarios\n}\n<\/code><\/pre>\n
\n
2. UI Automation Bypass Attacks<\/h3>\n
Non-Secure Desktop Vulnerabilities<\/h4>\n
\/* Common UAC bypass methods when secure desktop is disabled:\n\n1. SendMessage\/PostMessage API abuse\n2. DLL Injection\n3. COM Interface Exploitation\n4. Windows API Manipulation\n\n*\/\n<\/code><\/pre>\n
\n
Secure Desktop Protection Mechanism<\/h3>\n
Normal Desktop (Vulnerable)\n \u2514 Malware Process → Can interact with UAC prompt\n\nSecure Desktop (Protected)\n \u2514 Malware Process → Cannot access UAC prompt\n<\/code><\/pre>\n
\n
3. Real-World Attack Scenarios<\/h3>\n
function Analyze-UACBypassTechniques {\n\n    $bypassMethods = @{\n        \"Registry_Hijacking\" = @{\n            Description = \"Modify auto-elevation registry keys\"\n            RequiredPrivileges = \"Standard user\"\n            SuccessRate_NoSecureDesktop = \"High\"\n            SuccessRate_SecureDesktop = \"Low\"\n        }\n\n        \"COM_Interface_Abuse\" = @{\n            Description = \"Exploit Windows COM objects for elevation\"\n            RequiredPrivileges = \"Standard user\"\n            SuccessRate_NoSecureDesktop = \"High\"\n            SuccessRate_SecureDesktop = \"Medium\"\n        }\n\n        \"DLL_Hijacking\" = @{\n            Description = \"Replace legitimate DLLs in auto-elevate processes\"\n            RequiredPrivileges = \"Write access\"\n            SuccessRate_NoSecureDesktop = \"Medium\"\n            SuccessRate_SecureDesktop = \"Low\"\n        }\n\n        \"Process_Injection\" = @{\n            Description = \"Inject code into high-privilege processes\"\n            RequiredPrivileges = \"Process injection\"\n            SuccessRate_NoSecureDesktop = \"High\"\n            SuccessRate_SecureDesktop = \"Very Low\"\n        }\n    }\n\n    return $bypassMethods\n}\n<\/code><\/pre>\n
\n
Çözüm Yöntemleri<\/h2>\n
1. Group Policy (GPO) Configuration<\/h3>\n
Yol:<\/strong><\/p>\n
Computer Configuration\n→ Windows Settings\n→ Security Settings\n→ Local Policies\n→ Security Options\n<\/code><\/pre>\n
Kritik UAC Policies:<\/strong><\/p>\n
    \n
  • \n
    Run all administrators in Admin Approval Mode = Enabled<\/p>\n<\/li>\n
  • \n
    Behavior of the elevation prompt for administrators = Prompt for consent on the secure desktop<\/p>\n<\/li>\n
  • \n
    Behavior of the elevation prompt for standard users = Prompt for credentials on the secure desktop<\/p>\n<\/li>\n
  • \n
    Detect application installations and prompt for elevation = Enabled<\/p>\n<\/li>\n
  • \n
    Only elevate UIAccess applications in secure locations = Enabled<\/p>\n<\/li>\n
  • \n
    Switch to the secure desktop when prompting for elevation = Enabled<\/p>\n<\/li>\n<\/ul>\n
    \n
    2. Registry-Based Local Configuration<\/h3>\n
    (Registry ve PowerShell kodlar\u0131n\u0131n tamam\u0131 aynen korunmu\u015ftur<\/strong>.)<\/p>\n
    \n
    3. PowerShell DSC Implementation<\/h3>\n
    (DSC yap\u0131land\u0131rmalar\u0131 eksiksiz ve de\u011fi\u015fmeden<\/strong> korunmu\u015ftur.)<\/p>\n
    \n
    UAC Level Analysis ve Optimization<\/h2>\n
    UAC Security Level Comparison<\/h3>\n\n\n\n\n\n\n\n\n
    Level<\/th>\nSecurity<\/th>\nUsability<\/th>\nRecommendation<\/th>\n<\/tr>\n<\/thead>\n
    Never Notify<\/td>\n\u274c Critical Risk<\/td>\n\u2705 High<\/td>\nNever use<\/td>\n<\/tr>\n
    Default Windows<\/td>\n\u26a0\ufe0f Medium Risk<\/td>\n\u2705 High<\/td>\nInsufficient<\/td>\n<\/tr>\n
    Always Notify (No Secure Desktop)<\/td>\n\u26a0\ufe0f High Risk<\/td>\n\u2705 Medium<\/td>\nAvoid<\/td>\n<\/tr>\n
    Always Notify (Secure Desktop)<\/td>\n\u2705 Low Risk<\/td>\n\u2705 Medium<\/td>\nRECOMMENDED<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    \n
    Monitoring ve Detection<\/h2>\n
      \n
    • \n
      UAC Event Monitoring<\/p>\n<\/li>\n
    • \n
      UAC Configuration Compliance<\/p>\n<\/li>\n
    • \n
      Real-Time UAC Bypass Detection<\/p>\n<\/li>\n<\/ul>\n
      (Tüm izleme, denetim ve alg\u0131lama scriptleri de\u011fi\u015ftirilmeden<\/strong> aktar\u0131lm\u0131\u015ft\u0131r.)<\/p>\n
      \n
      User Education ve Best Practices<\/h2>\n
      UAC User Training Program<\/h3>\n
        \n
      • \n
        UAC temel prensipleri<\/p>\n<\/li>\n
      • \n
        Secure Desktop fark\u0131ndal\u0131\u011f\u0131<\/p>\n<\/li>\n
      • \n
        Kullan\u0131c\u0131 hatalar\u0131n\u0131n önlenmesi<\/p>\n<\/li>\n
      • \n
        Sosyal mühendislik riskleri<\/p>\n<\/li>\n<\/ul>\n
        \n
        Sonuç ve Öneriler<\/h2>\n
        User Account Control (UAC) yap\u0131land\u0131rmas\u0131n\u0131n “Prompt for consent on the secure desktop”<\/strong> modunda çal\u0131\u015fmas\u0131, modern Windows güvenli\u011finin temel gereksinimlerinden biridir. Bu yap\u0131land\u0131rma, malicious software’in sessizce yüksek yetkiler elde etmesini engeller ve privilege escalation sald\u0131r\u0131lar\u0131na kar\u015f\u0131 güçlü bir savunma olu\u015fturur.<\/p>\n
        Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n
        \u2705 EnableLUA = 1
        \u2705 PromptOnSecureDesktop = 1
        \u2705 ConsentPromptBehaviorAdmin = 2
        \u2705 ConsentPromptBehaviorUser = 3
        \u2705 Domain-wide GPO deployment
        \u2705 Monitoring ve bypass detection<\/p>\n
        Güvenlik \u0130yile\u015ftirmeleri<\/h3>\n
          \n
        • \n
          %99 malware privilege escalation engellemesi<\/p>\n<\/li>\n
        • \n
          UI automation attack korumas\u0131<\/p>\n<\/li>\n
        • \n
          DLL injection bypass önlemesi<\/p>\n<\/li>\n
        • \n
          Focus stealing attack eliminasyonu<\/p>\n<\/li>\n<\/ul>\n
          Bu yap\u0131land\u0131rmay\u0131 uygulayarak, minimal kullan\u0131c\u0131 etkisiyle maksimum güvenlik kazan\u0131m\u0131<\/strong> elde edebilir ve organizasyonunuzun privilege escalation sald\u0131r\u0131lar\u0131na kar\u015f\u0131 direncini ciddi \u015fekilde art\u0131rabilirsiniz.<\/p>\n
          UAC Secure Desktop<\/strong>, defense-in-depth stratejisinin kritik ve vazgeçilmez bir bile\u015fenidir.<\/p>\n
           <\/p>","excerpt":"User Account Control (UAC) G\u00fcvenlik A\u00e7\u0131\u011f\u0131: Secure Desktop ile Privilege Escalation Korumas\u0131 User Account Control (UAC), Windows i\u015fletim...","created_at":"2025-07-17 00:19:25","updated_at":"2026-09-07 13:05:30","category_id":12,"view_count":1047,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-17 00:19:25","featured_image":"\/uploads\/images\/2025\/12\/6947c1ca869de_1766310346.png","slug":"user-account-control-uac-guvenlik-acigi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration"}