UAC Bypass via WSReset.exe

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•17

Detects the execution of 'wsreset.exe' with elevated privileges (High or System integrity levels). This behavior is indicative of a User Account Control (UAC) bypass attempt, as 'wsreset.exe' is a legitimate Windows utility that can be abused to elevate privileges without a UAC prompt.