UAC Bypass via WSReset Execution Hijack

sequence with maxspan=60s
 [registry where
  registry.path :
      ("HKEY_USERS\\S-1-5-21-*Classes\\*\\Shell\\open\\command\\DelegateExecute",
       "HKEY_USERS\\S-1-12-1-*Classes\\*\\Shell\\open\\command\\DelegateExecute",
       "*\\ms-windows-store*")]
 [process where event.action == "start" and process.parent.name : "WSReset.exe" and
  process.Ext.token.integrity_level_name == "high" and
  not process.executable :
           ("?:\\Windows\\System32\\WerFault.exe",
            "?:\\Windows\\SysWOW64\\WerFault.exe",
            "?:\\Windows\\System32\\mmc.exe",
            "?:\\Windows\\SysWOW64\\mmc.exe",
            "?:\\Windows\\system32\\conhost.exe",
            "?:\\Windows\\SysWOW6\\conhost.exe")]