UAC Bypass Abusing Winsat Path Parsing - File — Detection Rule

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read the full analysis on IntelFusions