UAC Bypass Using Windows Media Player Registry Modification
Detects a specific UAC bypass technique leveraging Windows Media Player's `osk.exe` by monitoring modifications to a particular registry key. This technique, often associated with UACMe (specifically method 32), involves setting a 'Binary Data' value in the AppCompatFlags\Compatibility Assistant\Store registry path for `C:\Program Files\Windows Media Player\osk.exe`.
Sigma
