UAC Bypass Using Windows Media Player osksupport.dll via DllHost.exe (File Events)

title: UAC Bypass Using Windows Media Player osksupport.dll via DllHost.exe (File Events)
id: cbaa0ba0-73a8-4bec-b67b-8efddc192c66
status: test
description: This rule matches file-write or file-creation activity consistent with a UAC bypass workflow that uses Windows Media Player components. It looks for a target path under the current user Temp directory ending with OskSupport.dll, combined with DllHost.exe spawning or being associated with C:\Program Files\Windows Media Player\osk.exe. This matters because abusing these Windows binaries can enable elevation attempts that bypass user access controls. The detection relies on file event telemetry capturing the target file path and the involved process image path.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_wmp.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection1:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith: \AppData\Local\Temp\OskSupport.dll
  selection2:
    Image: C:\Windows\system32\DllHost.exe
    TargetFilename: C:\Program Files\Windows Media Player\osk.exe
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 68578b43-65df-4f81-9a9b-92f32711a951
    type: derived