From 00935f154eeced5b546311d6b54d72a822b54554 Mon Sep 17 00:00:00 2001
From: wokis <kacper@kacper.se>
Date: Wed, 20 Jan 2021 14:47:23 +0100
Subject: [PATCH] Update Wsreset.yml

Added detection by Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen
---
 yml/OSBinaries/Wsreset.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/yml/OSBinaries/Wsreset.yml b/yml/OSBinaries/Wsreset.yml
index 9a1cbdd..e0a9d7a 100644
--- a/yml/OSBinaries/Wsreset.yml
+++ b/yml/OSBinaries/Wsreset.yml
@@ -19,6 +19,7 @@ Code Sample:
 Detection:
  - IOC: wsreset.exe launching child process other than mmc.exe
  - IOC: Creation or modification of the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command
+ - IOC: Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen
 Resources:
   - Link: https://www.activecyber.us/activelabs/windows-uac-bypass
   - Link: https://twitter.com/ihack4falafel/status/1106644790114947073