Sigma rule: Potential Privilege Escalation Attempt Via .Exe.Local Technique

Rule

Title

Potential Privilege Escalation Attempt Via .Exe.Local Technique

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash)

Date

2022-12-16

Modified

2022-12-19

File

rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|startswith:
        - 'C:\Windows\System32\logonUI.exe.local'
        - 'C:\Windows\System32\werFault.exe.local'
        - 'C:\Windows\System32\consent.exe.local'
        - 'C:\Windows\System32\narrator.exe.local'
        - 'C:\Windows\System32\wermgr.exe.local'
    TargetFilename|endswith: '\comctl32.dll'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege-escalation
• attack.stealth

References

• https://github.com/binderlabs/DirCreate2System
• https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml