Windows UAC Bypass via pkgmgr.exe Launching dism.exe (High/System Integrity)

title: Windows UAC Bypass via pkgmgr.exe Launching dism.exe (High/System Integrity)
id: ea104f90-c14f-461d-afab-e541fe388908
status: test
description: This rule flags process executions where a parent process ending in \pkgmgr.exe spawns dism.exe while the child process runs with elevated integrity levels (including High and System-related SIDs). Such parent/child combinations are notable because they can support privilege escalation pathways by executing a high-integrity Windows component. The detection relies on process creation telemetry, specifically matching executable filename endings and integrity level attributes for the spawned process.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \pkgmgr.exe
    Image|endswith: \dism.exe
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a743ceba-c771-4d75-97eb-8a90f7f4844c
    type: derived