
title: UAC Bypass Abusing Winsat Path Parsing - Registry
author: Christian Burkard
date: 2021/08/30
description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe
  (UACMe 52)
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*\Root\InventoryApplicationFile\winsat.exe|*'
  SELECTION_5:
    TargetObject: '*\LowerCaseLongPath'
  SELECTION_6:
    Details: c:\users\\*
  SELECTION_7:
    Details: '*\appdata\local\temp\system32\winsat.exe'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5
    and SELECTION_6 and SELECTION_7)
falsepositives:
- Unknown
id: 6597be7b-ac61-4ac8-bef4-d3ec88174853
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://github.com/hfiref0x/UACME
status: experimental
tags:
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1548.002
ruletype: SIGMA
