BumbleBee DLL Sideloading: consent.exe Loading msimg32.dll Outside System32

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects the Windows UAC consent.exe process loading msimg32.dll from a non-standard, potentially user-writable location, a technique associated with BumbleBee malware campaigns for DLL sideloading. The rule further inspects the parent process context to ensure consent.exe was launched by an expected parent (svchost.exe) and validates the DLL's signature.