UAC Bypass Abusing Winsat Path Parsing
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
Sigma
