Windows UAC Bypass via dism.exe Loading Fake dismcore.dll

Alerts when dism.exe loads a dismcore.dll that is not the expected System32 Dism DLL.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: oscd.community, Dmitry Uchakin (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1548.002Bypass User Account Control
- T1574.001DLL
Defense Evasion
- T1548.002Bypass User Account Control
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows processes that load a dismcore.dll image while the initiating process path ends with \dism.exe, excluding the known legitimate System32\Dism\dismcore.dll location. Attackers may drop a crafted DLL to influence how dism.exe loads libraries, enabling stealthy execution as part of a UAC bypass technique. The detection relies on image load telemetry that records both the loaded DLL path and the loading executable path. It also accounts for a specific legitimate DLL location to reduce obvious false positives.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)

Suspicious propsys.dll Sideload via ComputerDefaults UAC Bypass (via image_load)

Malicious DLL Sideloading of wke.dll via DriverAssistant acvb (via image_load)

Malicious DLL Sideloading via consent.exe Loading msimg32.dll (via image_load)

Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)

Suspicious BugSplat Binary Sideloading bugsplatrc.dll via DLL Search Order Hijack

Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll

Suspicious 7-Zip Executable Sideloading 7z.dll Loader

Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor

Windows UAC Bypass via dism.exe Loading Fake dismcore.dll

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-uac-bypass-via-fake-dismcore-dll-loaded-by-dism-exe-a5ea83a7

title: Windows UAC Bypass via dism.exe Loading Fake dismcore.dll
id: 6be2fffd-6d65-491d-9640-b92b87758de6
status: test
description: This rule flags Windows processes that load a dismcore.dll image while the initiating process path ends with \dism.exe, excluding the known legitimate System32\Dism\dismcore.dll location. Attackers may drop a crafted DLL to influence how dism.exe loads libraries, enabling stealthy execution as part of a UAC bypass technique. The detection relies on image load telemetry that records both the loaded DLL path and the loading executable path. It also accounts for a specific legitimate DLL location to reduce obvious false positives.
references:
  - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_uac_bypass_via_dism.yml
author: oscd.community, Dmitry Uchakin, Huntrule Team
date: 2020-10-06
modified: 2022-12-25
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1548.002
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \dism.exe
    ImageLoaded|endswith: \dismcore.dll
  filter:
    ImageLoaded: C:\Windows\System32\Dism\dismcore.dll
  condition: selection and not filter
falsepositives:
  - Actions of a legitimate telnet client
level: high
license: DRL-1.1
related:
  - id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL