UAC Bypass Abusing Winsat Path Parsing - Registry

Status: test
Severity: high
Log source: category registry_set, product windows
Author: Christian Burkard (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: UAC Bypass Abusing Winsat Path Parsing - Registry
id: 6597be7b-ac61-4ac8-bef4-d3ec88174853
status: test
description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Root\InventoryApplicationFile\winsat.exe|'
        TargetObject|endswith: '\LowerCaseLongPath'
        Details|startswith: 'c:\users\'
        Details|endswith: '\appdata\local\temp\system32\winsat.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|contains: '\Root\InventoryApplicationFile\winsat.exe|'
    TargetObject|endswith: '\LowerCaseLongPath'
    Details|startswith: 'c:\users\'
    Details|endswith: '\appdata\local\temp\system32\winsat.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	ends_with	`\appdata\local\temp\system32\winsat.exe`	`field:"Details" kind:ends_with value:"\appdata\local\temp\system32\winsat.exe"`
`Details`	starts_with	`c:\users\`	`field:"Details" kind:starts_with value:"c:\users\"`
`TargetObject`	ends_with	`\LowerCaseLongPath`	`field:"TargetObject" kind:ends_with value:"\LowerCaseLongPath"`
`TargetObject`	match	`\Root\InventoryApplicationFile\winsat.exe\|`	`field:"TargetObject" kind:match value:"\Root\InventoryApplicationFile\winsat.exe\|"`

UAC Bypass Abusing Winsat Path Parsing - Registry

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`