Windows UAC bypass using wsreset.exe with high/SYSTEM integrity

title: Windows UAC bypass using wsreset.exe with high/SYSTEM integrity
id: f602ea46-48e1-40c2-af13-52a4c42a4c98
status: test
description: This rule flags process creation events where wsreset.exe runs with elevated integrity levels commonly associated with UAC bypass scenarios. Attackers abuse Windows components like wsreset.exe to attempt privilege escalation by launching a trusted binary in a context that indicates elevated execution. The detection relies on Windows process creation telemetry and the process integrity level reported for wsreset.exe (including High and SYSTEM-related SIDs).
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  - https://github.com/hfiref0x/UACME
  - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \wsreset.exe
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 89a9a0e0-f61a-42e5-8957-b1479565a658
    type: derived