All Detections

UAC Bypass Using IDiagnostic Profile - File

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Sigma