Authenticode and UAC

When a user attempts to run a file with elevated privilege, Windows will show a User Account Control elevation prompt that asks whether the user trusts the file to run. For a regular file, the user will see a prompt like this: For a file signed by a certificate in the Untrusted Certificates store, elevation is explicitly blocked: For a file with a trustworthy signature, the user is expected to see a prompt like this one: However, I’m sometimes sometimes surprised to encounter a different behavior when running signed files. Surprise #1 – Windows Files are Special The first surprise occurred last year when we were working testing the Defender Deployment tool. If we looked at the executable in File Explorer’s Properties dialog, we saw that it was correctly signed: However, when double-clicking the file in Explorer, the UAC prompt behaved as if the file were not signed. What gives? After investigation, I learned that UAC has a special carve out for files that are signed by the Windows…