splunk-security_content/dev/endpoint/wsreset_uac_bypass.yml

name: WSReset UAC Bypass
id: 8b5901bc-da63-11eb-be43-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This search is to detect a suspicious modification of registry related
  to UAC bypass. This technique is to modify the registry in this detection, create
  a registry value with the path of the payload and run WSreset.exe to bypass User
  account Control.
data_source:
- Sysmon Event ID 13
search:
  selection1:
    Registry.registry_value_name:
    - DelegateExecute
    - (Default)
    TargetObject: '*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*'
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
  that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: unknown
references:
- https://github.com/hfiref0x/UACME
- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
tags:
  analytic_story:
  - Windows Defense Evasion Tactics
  - Living Off The Land
  - Windows Registry Abuse
  asset_type: Endpoint
  confidence: 90
  impact: 70
  message: Suspicious modification of registry $registry_path$ with possible payload
    path $registry_value_name$ in $dest$
  mitre_attack_id:
  - T1548.002
  - T1548
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 63
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog