UAC Bypass Using Windows Media Player (UACMe 32)
Detects a User Account Control (UAC) bypass technique leveraging Windows Media Player's `osk.exe` in conjunction with `cmd.exe` and `mmc.exe` to achieve elevated privileges. This specific pattern is associated with UACMe bypass method 32, which exploits the `osksupport.dll` vulnerability. The rule looks for the creation of `osk.exe` from the Windows Media Player directory, followed by `cmd.exe` being launched with a specific parent command line involving `mmc.exe` and `eventvwr.msc`, all while maintaining a high or system integrity level.
Sigma
