Windows Process Creation: UAC Bypass via winsat.exe Path Parsing

title: "Windows Process Creation: UAC Bypass via winsat.exe Path Parsing"
id: 95f44408-469d-43b3-a90f-38782d75179a
status: test
description: This rule flags process creation where the parent process is winsat.exe launched from a Temp-based system32 path and the parent command line contains a Windows system32 winsat.exe reference. It also requires the resulting process to run with elevated integrity levels (High or System-related SIDs), which is consistent with privilege escalation attempts. Detection relies on Windows process creation telemetry including integrity level, parent image path, and parent command line content.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
    ParentImage|endswith: \AppData\Local\Temp\system32\winsat.exe
    ParentCommandLine|contains: C:\Windows \system32\winsat.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7a01183d-71a2-46ad-ad5c-acd989ac1793
    type: derived