mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-09-19 18:24:02 +02:00
4f83231697
* Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
33 lines
1.9 KiB
YAML
33 lines
1.9 KiB
YAML
---
|
|
Name: Wsreset.exe
|
|
Description: Used to reset Windows Store settings according to its manifest file
|
|
Author: 'Oddvar Moe'
|
|
Created: 2019-03-18
|
|
Commands:
|
|
- Command: wsreset.exe
|
|
Description: During startup, wsreset.exe checks the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command for the command to run. Binary will be executed as a high-integrity process without a UAC prompt being displayed to the user.
|
|
Usecase: Execute a binary or script as a high-integrity process without a UAC prompt.
|
|
Category: UAC Bypass
|
|
Privileges: User
|
|
MitreID: T1548.002
|
|
OperatingSystem: Windows 10, Windows 11
|
|
Full_Path:
|
|
- Path: C:\Windows\System32\wsreset.exe
|
|
Code_Sample:
|
|
- Code:
|
|
Detection:
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml#
|
|
- Splunk: https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/wsreset_uac_bypass.yml
|
|
- IOC: wsreset.exe launching child process other than mmc.exe
|
|
- IOC: Creation or modification of the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command
|
|
- IOC: Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen
|
|
Resources:
|
|
- Link: https://www.activecyber.us/activelabs/windows-uac-bypass
|
|
- Link: https://twitter.com/ihack4falafel/status/1106644790114947073
|
|
- Link: https://github.com/hfiref0x/UACME/blob/master/README.md
|
|
Acknowledgement:
|
|
- Person: Hashim Jawad
|
|
Handle: '@ihack4falafel'
|