VisualUiaVerifyNative.exe Execution on Windows
Alerts when VisualUiaVerifyNative.exe is launched on Windows, a potential application-control bypass binary.
- Product
- windows
- Category
- process_creation
- Author
- Christopher Peacock @SecurePeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
- Published
- 2022-06-01
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where VisualUiaVerifyNative.exe runs, identified by either the executable path ending with \VisualUiaVerifyNative.exe or OriginalFileName matching VisualUiaVerifyNative.exe. Attackers may use this Windows SDK component to support application control bypass scenarios, making unexpected execution a useful stealth signal. It relies on Windows process creation telemetry including the process image path and OriginalFileName.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
- bohops.comhttps://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/
- github.comhttps://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: VisualUiaVerifyNative.exe Execution on Windows
id: beedd309-fee6-4f4f-84dd-172198a92017
status: test
description: This rule flags process creation where VisualUiaVerifyNative.exe runs, identified by either the executable path ending with \VisualUiaVerifyNative.exe or OriginalFileName matching VisualUiaVerifyNative.exe. Attackers may use this Windows SDK component to support application control bypass scenarios, making unexpected execution a useful stealth signal. It relies on Windows process creation telemetry including the process image path and OriginalFileName.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
- https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/
- https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-01
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \VisualUiaVerifyNative.exe
- OriginalFileName: VisualUiaVerifyNative.exe
condition: selection
falsepositives:
- Legitimate testing of Microsoft UI parts.
level: medium
license: DRL-1.1
related:
- id: b30a8bc5-e21b-4ca2-9420-0a94019ac56a
type: derived