Windows UAC Bypass via .NET Code Profiler and mmc.exe DLL Write to Temp\pe386.dll

title: Windows UAC Bypass via .NET Code Profiler and mmc.exe DLL Write to Temp\pe386.dll
id: 3dc0230d-6fbd-4420-826a-75d7aa74bbe0
status: test
description: Detects file creation events where the target filename is under a user profile and ends with "\AppData\Local\Temp\pe386.dll". This pattern aligns with techniques that place a profiler-related DLL in a temporary directory to enable elevated behavior through mmc.exe context. The rule relies on Windows file event telemetry that includes the full target path written to disk.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith: \AppData\Local\Temp\pe386.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 93a19907-d4f9-4deb-9f91-aac4692776a6
    type: derived