UAC Bypass With Fake Dismcore DLL

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•1•0•20

This rule detects attempts to bypass User Account Control (UAC) by loading a fake 'dismcore.dll' with 'dism.exe'. This technique involves placing a malicious 'dismcore.dll' in a location where 'dism.exe' will load it instead of the legitimate system DLL, often leading to privilege escalation.