Windows UAC Bypass via Fake dismcore.dll Loaded by dism.exe

title: Windows UAC Bypass via Fake dismcore.dll Loaded by dism.exe
id: 6be2fffd-6d65-491d-9640-b92b87758de6
status: test
description: This rule flags cases where a dism.exe process loads a dismcore.dll from a suspicious location, rather than the expected System32 Dism path. Attackers can use fake DLL placement to influence DLL loading behavior and facilitate UAC bypass or privilege escalation while attempting to remain stealthy. The detection relies on Windows image load telemetry capturing both the process image name ending in \dism.exe and the loaded DLL name ending in \dismcore.dll, plus a negative check against the legitimate DLL path.
references:
  - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_uac_bypass_via_dism.yml
author: oscd.community, Dmitry Uchakin, Huntrule Team
date: 2020-10-06
modified: 2022-12-25
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1548.002
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \dism.exe
    ImageLoaded|endswith: \dismcore.dll
  filter:
    ImageLoaded: C:\Windows\System32\Dism\dismcore.dll
  condition: selection and not filter
falsepositives:
  - Actions of a legitimate telnet client
level: high
license: DRL-1.1
related:
  - id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03
    type: derived