Windows UAC Bypass via WoW64 Logger DLL Hijack (UACMe 30 Pattern)

Flags SysWOW64 process-access behavior with high granted access and unknown call traces consistent with a WoW64 logger DLL hijack UAC bypass.

FreeUnreviewedSigmahighv1

windows-uac-bypass-via-wow64-logger-dll-hijack-uacme-30-pattern-4f6c43e2

title: Windows UAC Bypass via WoW64 Logger DLL Hijack (UACMe 30 Pattern)
id: 28a42cfc-701c-40b7-9c27-da2bf0076a6c
status: test
description: This rule matches process-access activity consistent with a WoW64 logger DLL hijack used to bypass UAC. It is relevant because DLL hijacking can redirect execution paths in 32-bit/WoW64 components to elevate privileges without a standard consent flow. The detection relies on Windows process access telemetry, specifically the SourceImage path under SysWOW64, a broad GrantedAccess value, and a CallTrace prefix indicating unknown caller frames.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    SourceImage|contains: :\Windows\SysWOW64\
    GrantedAccess: "0x1fffff"
    CallTrace|startswith: UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4f6c43e2-f989-4ea5-bcd8-843b49a0317c
    type: derived

What it detects

This rule matches process-access activity consistent with a WoW64 logger DLL hijack used to bypass UAC. It is relevant because DLL hijacking can redirect execution paths in 32-bit/WoW64 components to elevate privileges without a standard consent flow. The detection relies on Windows process access telemetry, specifically the SourceImage path under SysWOW64, a broad GrantedAccess value, and a CallTrace prefix indicating unknown caller frames.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.