Windows Registry UAC Bypass Attempt via Windows Media Player osk.exe AppCompatFlags

title: Windows Registry UAC Bypass Attempt via Windows Media Player osk.exe AppCompatFlags
id: bd60becf-ef0d-4622-931f-720f9a25272e
status: test
description: This rule flags registry writes that set the AppCompatFlags Compatibility Assistant store entry for Windows Media Player’s osk.exe path with a value of “Binary Data”. Attackers abuse these compatibility settings to influence how Windows launches executables and potentially bypass User Account Control protections. The detection relies on Windows registry set telemetry capturing the TargetObject path ending in the specified osk.exe Store location and the corresponding Details value.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe
    Details: Binary Data
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5f9db380-ea57-4d1e-beab-8a2d33397e93
    type: derived