Title:UAC Bypass Using Windows Media Player - File Status:test Description:Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) References: -https://github.com/hfiref0x/UACME Author: Christian Burkard (Nextron Systems) Date: 2021-08-23 modified:2022-10-09 Tags:
-'attack.privilege-escalation'
-'attack.t1548.002'
Logsource:
category: file_event
product: windows
Detection: selection1: TargetFilename|startswith:
'C:\Users\' TargetFilename|endswith:
'\AppData\Local\Temp\OskSupport.dll' selection2: Image:
'C:\Windows\system32\DllHost.exe' TargetFilename:
'C:\Program Files\Windows Media Player\osk.exe' condition:1 of selection* Falsepositives:
-Unknown Level:high
