UAC Bypass Using .NET Code Profiler on MMC (UACMe 39)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.