[rule]
description = """
Identifies attempts to bypass User Account Control (UAC) via DLL side-loading from the trusted Windows Media Player
folder. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
"""
id = "2aac12a2-23e7-4557-950e-a7b9ab96a26d"
license = "Elastic License v2"
name = "UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder"
os_list = ["windows"]
reference = ["https://github.com/hfiref0x/UACME"]
version = "1.0.32"
query = '''
sequence with maxspan=60s
[file where event.action == "rename" and
process.name : "dllhost.exe" and
file.path : ("?:\\Program Files\\Windows Media Player\\*.dll", "?:\\Program Files (x86)\\Windows Media Player\\*.dll")]
[process where event.action == "start" and
process.Ext.token.integrity_level_name : ("high", "system") and
process.executable : ("?:\\Program Files\\Windows Media Player\\*.exe", "?:\\Program Files (x86)\\Windows Media Player\\*.dll")]
'''
min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.002"
name = "Bypass User Account Control"
reference = "https://attack.mitre.org/techniques/T1548/002/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"