UAC Bypass via Windows Media Player: DllHost.exe spawning osk.exe writing OskSupport.dll to Temp

Flags file events where Temp\OskSupport.dll is targeted alongside DllHost.exe and Windows Media Player\osk.exe, consistent with a UAC bypass attempt.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-08-23
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.002Bypass User Account Control
Defense Evasion
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches file activity consistent with a Windows Media Player UAC bypass workflow where DllHost.exe launches osk.exe and writes OskSupport.dll into a user Temp path (OskSupport.dll under AppData\Local\Temp). The behavior matters because it can be used to attempt privilege escalation by placing attacker-controlled or hijack-related binaries in a writable location. It relies on file event telemetry capturing both the target filenames and the originating executable path.

Reporting behind it

Related detections9 linkedT1548.002 — drag to rearrange

Malicious FodHelper UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

Malicious UAC Bypass via sdclt Handler Hijack (via registry_set)

Malicious UAC Bypass via ms-settings Handler Hijack (via registry_set)

Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

Malicious User Account Control Bypass via Auto-Elevating Binary Hijack (via process_creation)

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

UAC Bypass via Windows Media Player: DllHost.exe spawning osk.exe writing OskSupport.dll to Temp

Pivot detection · T1548.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

uac-bypass-using-windows-media-player-osksupport-dll-via-dllhost-exe-file-events-68578b43

title: "UAC Bypass via Windows Media Player: DllHost.exe spawning osk.exe writing OskSupport.dll to Temp"
id: cbaa0ba0-73a8-4bec-b67b-8efddc192c66
status: test
description: This rule matches file activity consistent with a Windows Media Player UAC bypass workflow where DllHost.exe launches osk.exe and writes OskSupport.dll into a user Temp path (OskSupport.dll under AppData\Local\Temp). The behavior matters because it can be used to attempt privilege escalation by placing attacker-controlled or hijack-related binaries in a writable location. It relies on file event telemetry capturing both the target filenames and the originating executable path.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_wmp.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection1:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith: \AppData\Local\Temp\OskSupport.dll
  selection2:
    Image: C:\Windows\system32\DllHost.exe
    TargetFilename: C:\Program Files\Windows Media Player\osk.exe
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 68578b43-65df-4f81-9a9b-92f32711a951
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL