Windows Registry UAC Bypass via winsat.exe LowerCaseLongPath and UACMe Path Parsing

Matches registry writes that reference winsat.exe using a LowerCaseLongPath construction consistent with UAC bypass path parsing.

FreeUnreviewedSigmahighv1

windows-registry-uac-bypass-via-winsat-exe-lowercaselongpath-and-uacme-path-pars-6597be7b

title: Windows Registry UAC Bypass via winsat.exe LowerCaseLongPath and UACMe Path Parsing
id: c390b688-6ab4-49d2-b447-aa2f4ec669d1
status: test
description: This rule flags registry entries where TargetObject indicates a winsat.exe path parsed through a LowerCaseLongPath component, matching a specific UAC bypass-style construction. Attackers may use this kind of path parsing abuse to trigger elevated behavior without direct authorization. The detection relies on registry_set telemetry capturing TargetObject and Details fields that contain the expected winsat.exe and temp path patterns.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Root\InventoryApplicationFile\winsat.exe|
    TargetObject|endswith: \LowerCaseLongPath
    Details|startswith: c:\users\
    Details|endswith: \appdata\local\temp\system32\winsat.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6597be7b-ac61-4ac8-bef4-d3ec88174853
    type: derived

What it detects

This rule flags registry entries where TargetObject indicates a winsat.exe path parsed through a LowerCaseLongPath component, matching a specific UAC bypass-style construction. Attackers may use this kind of path parsing abuse to trigger elevated behavior without direct authorization. The detection relies on registry_set telemetry capturing TargetObject and Details fields that contain the expected winsat.exe and temp path patterns.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.