Windows UAC Bypass via IDiagnosticProfileUAC Triggered from DllHost.exe

title: Windows UAC Bypass via IDiagnosticProfileUAC Triggered from DllHost.exe
id: 1cf30ea5-d20a-4a68-b6e5-e25961505403
status: test
description: This rule matches process creation events where DllHost.exe is the parent process running with a command line containing the specific /Processid argument and where the child process integrity level is High, System, or one of the listed High/System SIDs. UAC bypass attempts often rely on trusted system components to launch operations with elevated privileges, making this parent-child and integrity combination important for identifying escalation behavior. The detection relies on Windows process creation telemetry, including parent image, parent command line, and the integrity level or corresponding integrity SIDs reported for the created process.
references:
  - https://github.com/Wh04m1001/IDiagnosticProfileUAC
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-03
modified: 2024-12-01
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \DllHost.exe
    ParentCommandLine|contains: " /Processid:{12C21EA7-2EB8-4B55-9249-AC243DA8C666}"
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4cbef972-f347-4170-b62a-8253f6168e6d
    type: derived