UAC Bypass Using PkgMgr and DISM
This rule detects a specific User Account Control (UAC) bypass technique that involves `pkgmgr.exe` launching `dism.exe` with elevated integrity levels. This behavior is characteristic of UACMe, a tool used to discover and implement UAC bypasses. The rule specifically looks for `dism.exe` being spawned as a child process of `pkgmgr.exe` and operating at 'High' or 'System' integrity levels, or their corresponding Security Identifier (SID) representations.
Sigma
