Potential Privilege Escalation via Elevated IFileOperation

sequence with maxspan=1m
  [file where event.action in ("creation", "overwrite", "rename", "modification") and

   /* IFileOperation are performed by DllHost */
   process.name : "dllhost.exe" and user.id like ("S-1-5-21*", "S-1-12-*") and

   /* executable file dropped via NewItem, Rename, Move or Copy IFileOperation */
   (file.extension : "dll" or file.Ext.header_bytes : "4d5a*") and

   /* protected system paths usually abused via DLL search order hijack */
   file.path : ("?:\\Windows\\system32\\*",
                "?:\\Windows\\syswow64\\*",
                "?:\\Program Files (x86)\\Microsoft\\*",
                "?:\\Program Files\\Microsoft\\*",
                "?:\\Program Files\\Windows *", 
                "?:\\Program Files (x86)\\Windows *")] by file.path
  [library where
   /* non MS signed */
   process.executable :
               ("?:\\Windows\\system32\\*",
                "?:\\Windows\\syswow64\\*",
                "?:\\Program Files (x86)\\Microsoft\\*",
                "?:\\Program Files\\Microsoft\\*", 
                "?:\\Program Files\\Windows *", 
                "?:\\Program Files (x86)\\Windows *") and
  not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true) and
  not startswith~(dll.name, process.name) and
  not dll.hash.sha256 :
               ("5177f7b0d88bf122b2b7e94293513cefee82970d8b5697e12821ccbe091c8e15",
                "108c16cecced0112da8095053c4efce83eeca319bf58f83412f8cf7f124a7dd5",
                "ed9ebcff2f6f28511814e726f701ab759398c3132a7382e28dd7c6ed58d32d90")] by dll.path