UAC Bypass Using IDiagnostic Profile - File Creation
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Sigma
