Windows Process UAC Bypass via Windows Media Player osksupport.dll (osk.exe → cmd.exe)

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.002Bypass User Account Control
Defense Evasion
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where Windows Media Player osk.exe is launched and a cmd.exe process appears with an mmc.exe parent that includes the event viewer snap-in. The combination of the specific executable path and high/system integrity targets behavior commonly associated with UAC bypass attempts. It relies on process creation telemetry capturing process Image, parent Image/command line, and the integrity level of the spawned process.

Reporting behind it

Related detections9 linkedT1548.002 — drag to rearrange

Malicious FodHelper UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

Malicious UAC Bypass via sdclt Handler Hijack (via registry_set)

Malicious UAC Bypass via ms-settings Handler Hijack (via registry_set)

Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

Malicious User Account Control Bypass via Auto-Elevating Binary Hijack (via process_creation)

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

Windows Process UAC Bypass via Windows Media Player osksupport.dll (osk.exe → cmd.exe)

Pivot detection · T1548.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-uac-bypass-via-windows-media-player-osksupport-dll-osk-exe-cmd-e-0058b9e5

title: Windows Process UAC Bypass via Windows Media Player osksupport.dll (osk.exe → cmd.exe)
id: 3f6212d8-970a-460d-b9d3-af2e88429ed4
status: test
description: This rule flags process creation where Windows Media Player osk.exe is launched and a cmd.exe process appears with an mmc.exe parent that includes the event viewer snap-in. The combination of the specific executable path and high/system integrity targets behavior commonly associated with UAC bypass attempts. It relies on process creation telemetry capturing process Image, parent Image/command line, and the integrity level of the spawned process.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_1:
    Image: C:\Program Files\Windows Media Player\osk.exe
  selection_img_2:
    Image: C:\Windows\System32\cmd.exe
    ParentCommandLine: '"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s'
  selection_integrity:
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: 1 of selection_img_* and selection_integrity
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0058b9e5-bcd7-40d4-9205-95ca5a16d7b2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL