Windows Process Creation: WSReset.exe Used with Non-CONHOST Child Process

Alerts when wsreset.exe spawns a process other than conhost.exe, a potential UAC-bypass precursor.

FreeUnreviewedSigmahighv1

windows-process-creation-wsreset-exe-used-with-non-conhost-child-process-d797268e

title: "Windows Process Creation: WSReset.exe Used with Non-CONHOST Child Process"
id: 00574c95-9810-4b4e-b54d-3de92a031bca
related:
  - id: bdc8918e-a1d5-49d1-9db7-ea0fd91aa2ae
    type: obsolete
  - id: d797268e-28a9-49a7-b9a8-2f5039011c5c
    type: derived
status: test
description: This rule flags process creation events where the parent process is wsreset.exe and the child process is not conhost.exe. Using wsreset.exe as a parent can indicate an attempt to trigger execution paths that lead to elevated actions, which matters because it may enable privilege escalation. It relies on Windows process creation telemetry, specifically the parent executable path and the spawned child executable identity (including OriginalFileName and conhost filtering).
references:
  - https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  - https://www.activecyber.us/activelabs/windows-uac-bypass
  - https://twitter.com/ReaQta/status/1222548288731217921
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth, Huntrule Team
date: 2019-10-24
modified: 2022-05-13
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \wsreset.exe
  filter:
    - Image|endswith: \conhost.exe
    - OriginalFileName: CONHOST.EXE
  condition: selection and not filter
falsepositives:
  - Unknown sub processes of Wsreset.exe
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where the parent process is wsreset.exe and the child process is not conhost.exe. Using wsreset.exe as a parent can indicate an attempt to trigger execution paths that lead to elevated actions, which matters because it may enable privilege escalation. It relies on Windows process creation telemetry, specifically the parent executable path and the spawned child executable identity (including OriginalFileName and conhost filtering).

Known false positives

Unknown sub processes of Wsreset.exe

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.