Skip to content
Threat Feed
Subscribe
high advisory

Windows: User Account Control bypass via WSReset.exe

Adversaries use the WSReset.exe binary to bypass User Account Control (UAC) and execute privileged processes.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Sources
5 public sources
Freshness
Revision 1Nov 10, 03:07 UTC
Detection
1 rule
Source quality
A2Roughly even chance

WSReset.exe is a Windows binary that can be abused to bypass User Account Control (UAC). Adversaries leverage this technique to execute processes with elevated privileges.

Detection

The provided detection logic identifies suspicious activity by monitoring for child processes spawned by WSReset.exe, excluding the legitimate console host (conhost.exe).

Detection coverage 1

Detect UAC Bypass via WSReset.exe

high

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

sigma tactics: privilege-escalation techniques: T1548.002 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →