title: Wsreset UAC Bypass
id: bdc8918e-a1d5-49d1-9db7-ea0fd91aa2ae
status: test
description: Detects a method that uses Wsreset.exe tool that can be used to reset the Windows Store to bypass UAC
author: Florian Roth
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  - https://www.activecyber.us/activelabs/windows-uac-bypass
  - https://twitter.com/ReaQta/status/1222548288731217921
date: 2020/01/30
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WSreset.exe'
  condition: selection
fields:
  - CommandLine
falsepositives:
  - Unknown sub processes of Wsreset.exe
level: high
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1548.002
