
title: UAC Bypass Via Wsreset
author: oscd.community, Dmitry Uchakin
date: 2020/10/07
description: Unfixed method for UAC bypass from windows 10. WSReset.exe file associated
  with the Windows Store. It will run a binary file contained in a low-privilege registry.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject:
    - '*\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4)
falsepositives:
- unknown
fields:
- ComputerName
- Image
- EventType
- TargetObject
id: 6ea3bf32-9680-422d-9f50-e90716b12a66
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly
- https://lolbas-project.github.io/lolbas/Binaries/Wsreset
status: experimental
tags:
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1548.002
ruletype: SIGMA
