VisualUiaVerifyNative.exe

type: OtherMSBinaries

A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.

Full path

c:\Program Files (x86)\Windows Kits\10\bin\<version>\arm64\UIAVerify\VisualUiaVerifyNative.exe
c:\Program Files (x86)\Windows Kits\10\bin\<version>\x64\UIAVerify\VisualUiaVerifyNative.exe
c:\Program Files (x86)\Windows Kits\10\bin\<version>\UIAVerify\VisualUiaVerifyNative.exe

Commands

AWL BypassUser T1218
Execute proxied payload with Microsoft signed binary to bypass WDAC policies
```
VisualUiaVerifyNative.exe
```
Generate Serialized gadget and save to - C:\Users\%USERNAME%\AppData\Roaminguiverify.config before executing.
os: Windows 10 2004 (likely previous and newer versions as well)
Execute: .NetObjects

Detection

BlockRule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Sigma https://github.com/SigmaHQ/sigma/blob/6b34764215b0e97e32cbc4c6325fc933d2695c3a/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml
IOCAs a Windows SDK binary, execution on a system may be suspicious

Resources

acknowledgement: Lee Christensen @tifkin, Jimmy @bohops