Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config
Read the full analysis on IntelFusions