Windows UAC Bypass via DismHost.exe DLL Hijacking

Flags DismHost.exe executions from AppData\Local\Temp running as High/System integrity, consistent with UAC bypass via DLL hijacking.

FreeUnreviewedSigmahighv1

windows-uac-bypass-via-dismhost-exe-dll-hijacking-853e74f9

title: Windows UAC Bypass via DismHost.exe DLL Hijacking
id: d5b8686f-e095-44c8-82d2-f39101a17173
status: test
description: This rule identifies process creation events where DismHost.exe is launched from a user’s AppData\Local\Temp path under high or system integrity contexts. Such behavior can indicate DLL hijacking used to bypass UAC and execute attacker-controlled code with elevated privileges. The detection relies on process creation telemetry capturing ParentImage, command path context, and integrity level values.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains|all:
      - C:\Users\
      - \AppData\Local\Temp\
      - \DismHost.exe
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 853e74f9-9392-4935-ad3b-2e8c040dae86
    type: derived

What it detects

This rule identifies process creation events where DismHost.exe is launched from a user’s AppData\Local\Temp path under high or system integrity contexts. Such behavior can indicate DLL hijacking used to bypass UAC and execute attacker-controlled code with elevated privileges. The detection relies on process creation telemetry capturing ParentImage, command path context, and integrity level values.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.