
title: UAC Bypass Using Windows Media Player - Registry
author: Christian Burkard
date: 2021/08/23
description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll
  (UACMe 32)
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility
      Assistant\Store\C:\Program Files\Windows Media Player\osk.exe'
  SELECTION_5:
    Details: Binary Data
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5)
falsepositives:
- Unknown
id: 5f9db380-ea57-4d1e-beab-8a2d33397e93
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://github.com/hfiref0x/UACME
status: experimental
tags:
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1548.002
ruletype: SIGMA
