Unusual Windows User Privilege Elevation Activity

 1[metadata]
 2creation_date = "2020/03/25"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2023/07/27"
 6min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 7min_stack_version = "8.3.0"
 8
 9[rule]
10anomaly_threshold = 50
11author = ["Elastic"]
12description = """
13A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can
14indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas
15are more commonly used by domain and network administrators than by regular Windows users.
16"""
17false_positives = [
18    """
19    Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user
20    performing manual troubleshooting or reconfiguration.
21    """,
22]
23from = "now-45m"
24interval = "15m"
25license = "Elastic License v2"
26machine_learning_job_id = ["v3_windows_rare_user_runas_event"]
27name = "Unusual Windows User Privilege Elevation Activity"
28references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"]
29risk_score = 21
30rule_id = "1781d055-5c66-4adf-9d82-fc0fa58449c8"
31severity = "low"
32tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Rule Type: ML", "Rule Type: Machine Learning", "Tactic: Privilege Escalation"]
33type = "machine_learning"
34
35[[rule.threat]]
36framework = "MITRE ATT&CK"
37[rule.threat.tactic]
38id = "TA0004"
39name = "Privilege Escalation"
40reference = "https://attack.mitre.org/tactics/TA0004/"```