UAC Bypass Abusing Winsat Path Parsing - Registry — Detection Rule

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read the full analysis on IntelFusions