UAC Bypass WSReset
Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config
Sigma rule (View on GitHub)
1title: UAC Bypass WSReset
2id: 89a9a0e0-f61a-42e5-8957-b1479565a658
3status: test
4description: Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config
5references:
6 - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
7 - https://github.com/hfiref0x/UACME
8 - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
9author: Christian Burkard (Nextron Systems)
10date: 2021/08/23
11modified: 2022/10/09
12tags:
13 - attack.defense_evasion
14 - attack.privilege_escalation
15 - attack.t1548.002
16logsource:
17 category: process_creation
18 product: windows
19detection:
20 selection:
21 Image|endswith: '\wsreset.exe'
22 IntegrityLevel:
23 - 'High'
24 - 'System'
25 condition: selection
26falsepositives:
27 - Unknown
28level: high
References
Related rules
- Shell Open Registry Keys Manipulation
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI