CVE-2026-25852 — Privilege Escalation

title: CVE-2026-25852 - Acronis DeviceLock DLP DLL Hijacking Attempt
id: scw-2026-04-29-ai-1
status: experimental
level: high
description: |
  Detects a potential DLL hijacking attempt targeting Acronis DeviceLock DLP's DeviceLockService.exe. This rule specifically looks for the loading of a potentially malicious kernel32.dll from a user-writable directory (like C:\Users\) by the DeviceLockService.exe, which is indicative of CVE-2026-25852.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-25852/
tags:
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
    category: image_load
detection:
  selection:
      ImageLoaded|endswith:
          - '\DeviceLockService.exe'
      TargetFilename|contains:
          - 'System32\kernel32.dll'
      Image|contains:
          - 'C:\Users\'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse