UAC Bypass Using NTFS Reparse Point and WUSA/DISM
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
Sigma
