UAC Bypass Abusing Winsat Path Parsing - File Creation
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
Sigma
