File event: Detect UAC bypass attempt via winsat.exe path parsing in Temp

title: "File event: Detect UAC bypass attempt via winsat.exe path parsing in Temp"
id: 4d1db176-cfc7-481a-82ae-e3f43a42bce6
status: test
description: This rule matches Windows file events where the target filename starts with C:\Users\ and ends in AppData\Local\Temp\system32\winsat.exe (or winmm.dll). Abusing winsat.exe through a path parsing flaw is used to attempt privilege escalation by bypassing UAC protections. Telemetry relies on file_event fields that expose the full target filename, including both the user-profile prefix and the specific Temp\system32 executable path.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_winsat.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith:
      - \AppData\Local\Temp\system32\winsat.exe
      - \AppData\Local\Temp\system32\winmm.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 155dbf56-e0a4-4dd0-8905-8a98705045e8
    type: derived