Bumblebee DLL Sideload via Trojanized MSI - consent.exe Loading msimg32.dll

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects anomalous activity involving the Windows consent.exe process, which handles User Account Control (UAC) elevation prompts. Specifically, this rule monitors for instances where consent.exe is spawned from the Temp folder, spawned by msiexec.exe from the Temp folder, or loads a suspicious version of msimg32.dll from a non-System32 directory. These behaviors are often indicative of UAC bypass attempts or DLL hijacking related to privilege escalation.