Skip to content
Threat Feed
Subscribe
high advisory

Windows: UAC bypass via iscsicpl.exe DLL hijacking

An attacker can elevate privileges via a UAC bypass by performing DLL hijacking against iscsicpl.exe.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 10, 02:46 UTC
Detection
1 rule
Source quality
B2Likely

The iscsicpl.exe utility on Windows is vulnerable to a UAC bypass technique. Attackers can exploit the DLL search order by placing a malicious 'iscsiexe.dll' in a user-controlled location, such as a temp directory, which the process will then load instead of the legitimate system DLL. This allows for arbitrary code execution with elevated privileges.

Impact

Successful exploitation allows a low-privilege user to execute arbitrary code with elevated administrative privileges, effectively bypassing User Account Control (UAC) protections.

Recommendation

  • Deploy the provided Sigma rule to monitor for suspicious image loads.
  • Audit user-writable directories for the presence of 'iscsiexe.dll'.
  • Restrict write permissions in directories that are frequently searched by the system's DLL search order.

Immediate actions

Deploy the Sigma detection rule to the environment

Detection Engineering 48h

Threat Hunt

Search for process image loads of iscsiexe.dll originating from directories other than C:\Windows\

T1548.002 high high confidence hunt now

Data: Sysmon Event ID 7

Detection coverage 1

Detect UAC Bypass via iscsicpl.exe DLL Hijacking

high

Detects the iscsicpl.exe UAC bypass technique that leverages DLL search order hijacking to load a custom DLL from a user-controlled location.

sigma tactics: privilege-escalation techniques: T1548.002 sources: image_load, windows

Detection queries are available on the platform. Get full rules →