Process creation of VisualUiaVerifyNative.exe on Windows

Alerts when VisualUiaVerifyNative.exe is launched on Windows, a potential application-control bypass binary.

FreeUnreviewedSigmamediumv1

process-creation-of-visualuiaverifynative-exe-on-windows-b30a8bc5

title: Process creation of VisualUiaVerifyNative.exe on Windows
id: beedd309-fee6-4f4f-84dd-172198a92017
status: test
description: This rule flags the execution of VisualUiaVerifyNative.exe based on process creation events where the image path ends with the binary name and the OriginalFileName matches. VisualUiaVerifyNative.exe is a Windows SDK binary that can be abused to bypass application control in certain environments, making its presence a meaningful signal for policy evasion. Telemetry required is Windows process creation data including Image and OriginalFileName fields.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
  - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/
  - https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-01
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \VisualUiaVerifyNative.exe
    - OriginalFileName: VisualUiaVerifyNative.exe
  condition: selection
falsepositives:
  - Legitimate testing of Microsoft UI parts.
level: medium
license: DRL-1.1
related:
  - id: b30a8bc5-e21b-4ca2-9420-0a94019ac56a
    type: derived

What it detects

This rule flags the execution of VisualUiaVerifyNative.exe based on process creation events where the image path ends with the binary name and the OriginalFileName matches. VisualUiaVerifyNative.exe is a Windows SDK binary that can be abused to bypass application control in certain environments, making its presence a meaningful signal for policy evasion. Telemetry required is Windows process creation data including Image and OriginalFileName fields.

Known false positives

Legitimate testing of Microsoft UI parts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.