UAC Bypass Using DismHost DLL Hijacking
Detects a specific pattern indicative of a User Account Control (UAC) bypass technique using DismHost DLL hijacking. This method, often associated with UACMe (specifically UACMe 63), involves a process named 'DismHost.exe' being launched from a user's temporary directory with elevated integrity levels (High or System). This behavior is suspicious because DismHost.exe is a legitimate Windows component, but its execution from a temporary user-specific path with elevated privileges suggests an attempt to bypass UAC.
Sigma
