BIOC
Low
✕
WSReset.exe UAC bypass
Attackers may use WSReset.exe to bypass User Account Control (UAC).
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Privilege Escalation
- Status:
- Enabled
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
Indicator:
Process action type = execution AND target process name != conhost.exe AND mmc.exe Process initiated by = wsreset.exe , cgo name = wsreset.exe
Preventable: yes