Identifier / Programs / Windows

wsreset.exe

This tool resets the Windows Store without changing account settings or deleting installed apps file version info (xCyclopedia)

LOLBAS UAC Bypass 1 Sigma rule name it 1 ATT&CK technique 1 documented command 6 known copies with hashes

How wsreset.exe is abused

documented by LOLBAS

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wsreset.exe.

1 documented command

from LOLBAS, each read by the identifier

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control User privileges

During startup, wsreset.exe checks the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command for the command to run. Binary will be executed as a high-integrity process without a UAC prompt being displayed to the user.

wsreset.exe

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wsreset.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wsreset.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highUAC Bypass WSResetChristian Burkard (Nextron Systems)

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real wsreset.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionThis tool resets the Windows Store without changing account settings or deleting installed apps

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WSReset.exe · signed by Microsoft Windows

0edd534686643b1770d6897eab387b9d2a82fc57593ada049f1dc807fe792253

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\WSReset.exe · signed by Microsoft Windows

2f59cfe63442b61f8aaef0e1471d40dbc8ae91d4697bde7699e9d0f3f1aece1a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WSReset.exe · signed by Microsoft Windows

e1e8f9fb5503a7ec9731bc81cdd3f428001c2afb0528cf99da451c5220a1580f

10.0.18362.145 (WinBuild.160101.0800) · C:\WINDOWS\system32\WSReset.exe · signed by Microsoft Windows

8d7ab0e208a39ad318b3f3837483f34e0fa1c3f20edf287fb7c8d8fa1ac63a2f

10.0.17763.592 (WinBuild.160101.0800) · C:\Windows\system32\WSReset.exe · signed by Microsoft Windows

5fdda5d5e3ae48a72cd3e71410bf0a67512b7793006cab5878d1361000616ad6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WSReset.exe · signed by Microsoft Windows

bf90ecd7cea6870a9ef6e8cc818c993f0904cc89cb5ce8e8843972b26f05b29e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.