huntrule

Windows: UAC Bypass via IDiagnosticProfileUAC—dllhost.exe Writing DLL in System32

Alerts when dllhost.exe creates a System32 .dll consistent with IDiagnosticProfileUAC UAC bypass behavior.

FreeUnreviewedSigmahighv1
title: "Windows: UAC Bypass via IDiagnosticProfileUAC—dllhost.exe Writing DLL in System32"
id: ba4936ac-9c73-4593-bc7f-f06c00a13486
status: test
description: This rule flags file creation where dllhost.exe writes a DLL to the C:\Windows\System32 directory. Creating System32 DLLs from dllhost.exe is a behavior commonly associated with UAC bypass chains, as it can support executing attacker-controlled code in a trusted path. The detection relies on file event telemetry containing the process image name and the target file path.
references:
  - https://github.com/Wh04m1001/IDiagnosticProfileUAC
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-03
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \DllHost.exe
    TargetFilename|startswith: C:\Windows\System32\
    TargetFilename|endswith: .dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 48ea844d-19b1-4642-944e-fe39c2cc1fec
    type: derived

What it detects

This rule flags file creation where dllhost.exe writes a DLL to the C:\Windows\System32 directory. Creating System32 DLLs from dllhost.exe is a behavior commonly associated with UAC bypass chains, as it can support executing attacker-controlled code in a trusted path. The detection relies on file event telemetry containing the process image name and the target file path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.