WAC Privesc Updater DLL Hijack CVE-2025-64669

Tim Peck@timpeck

•updated Dec 15, 2025•2•0•73

Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.