Potential Privilege Escalation via .Exe.Local DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects a potential privilege escalation attempt by monitoring the creation of specific ".Exe.Local" folders within the "System32" directory. This technique is used to sideload "comctl32.dll" into legitimate Windows processes, which can lead to privilege escalation or persistence.