LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Wsreset.exe

View source

Used to reset Windows Store settings according to its manifest file

UAC Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

UAC Bypass1

EXAMPLE 01T1548.002

During startup, wsreset.exe checks the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command for the command to run. Binary will be executed as a high-integrity process without a UAC prompt being displayed to the user.

COMMAND
wsreset.exe
USE CASE
Execute a binary or script as a high-integrity process without a UAC prompt.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\wsreset.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    wsreset.exe launching child process other than mmc.exe

  • IOC

    Creation or modification of the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command

  • IOC

    Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Hashim Jawad@ihack4falafel