LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

VisualUiaVerifyNative.exe

View source

A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.

AWL Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

AWL Bypass1

EXAMPLE 01T1218

Generate Serialized gadget and save to - `C:\Users\%USERNAME%\AppData\Roaminguiverify.config` before executing.

COMMAND
VisualUiaVerifyNative.exe
USE CASE
Execute proxied payload with Microsoft signed binary to bypass WDAC policies
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 2004 (likely previous and newer versions as well)
Execute · .NetObjects
02 / ON DISK

Known paths

c:\Program Files (x86)\Windows Kits\10\bin\<version>\arm64\UIAVerify\VisualUiaVerifyNative.exe
c:\Program Files (x86)\Windows Kits\10\bin\<version>\x64\UIAVerify\VisualUiaVerifyNative.exe
c:\Program Files (x86)\Windows Kits\10\bin\<version>\UIAVerify\VisualUiaVerifyNative.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    As a Windows SDK binary, execution on a system may be suspicious

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Lee Christensen@tifkin
Jimmy@bohops