Used to reset Windows Store settings according to its manifest file Located at: C:\Windows\System32\wsreset.exe.
wsresetwsresetSandbox: execFile · Timeout: 30s
security.privilege-escalation.uac-bypass Outputs
process.output Command execution output
privilege_escalationprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
During startup, wsreset.exe checks the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command for the command to run. Binary will be executed as a high-integrity process without a UAC prompt being displayed to the user. (Execute a binary or script as a high-integrity process without a UAC prompt.)
wsreset.exe| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml# |
| splunk | https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/wsreset_uac_bypass.yml |
| ioc | wsreset.exe launching child process other than mmc.exe |
| ioc | Creation or modification of the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command |
| ioc | Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen |
wsreset is a Windows LOLBin. Used to reset Windows Store settings according to its manifest file Located at: C:\Windows\System32\wsreset.exe.