UAC bypass via DLL hijack from Windows Media player directory

Identifies potential User Account Control (UAC) bypass activity through DLL hijacking involving components loaded from the Windows Media Player installation directory. Adversaries may leverage trusted Windows Media Player binaries or their associated dynamic-link libraries to execute arbitrary code with elevated context.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1548, T1548.002

Back to all rules