huntrule

Windows UAC Bypass via dism.exe Loading Fake dismcore.dll

Alerts when dism.exe loads a dismcore.dll that is not the expected System32 Dism DLL.

FreeReviewedSigma · High · v2
Product
windows
Category
image_load
Author
oscd.community, Dmitry Uchakin (SigmaHQ), DRL 1.1
Published
2020-10-06
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows processes that load a dismcore.dll image while the initiating process path ends with \dism.exe, excluding the known legitimate System32\Dism\dismcore.dll location. Attackers may drop a crafted DLL to influence how dism.exe loads libraries, enabling stealthy execution as part of a UAC bypass technique. The detection relies on image load telemetry that records both the loaded DLL path and the loading executable path. It also accounts for a specific legitimate DLL location to reduce obvious false positives.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange
Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)
Suspicious propsys.dll Sideload via ComputerDefaults UAC Bypass (via image_load)
Malicious DLL Sideloading of wke.dll via DriverAssistant acvb (via image_load)
Suspicious Service DLL Hijack of IKEEXT or PrintNotify
Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary
Suspicious msimg32.dll Loaded from Non-System Directory
DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL
Malicious FodHelper UAC Bypass via ms-settings Shell Command Hijack (via registry_set)
Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)
Windows UAC Bypass via dism.exe Loading Fake dismcore.dll
Pivot detection · T1574.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.