Potential Privilege Escalation via InstallerFileTakeOver

  1[metadata]
  2creation_date = "2021/11/25"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation
 11allows an unprivileged user to escalate privileges to SYSTEM.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.process-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Potential Privilege Escalation via InstallerFileTakeOver"
 18references = ["https://github.com/klinix5/InstallerFileTakeOver"]
 19risk_score = 73
 20rule_id = "58c6d58b-a0d3-412d-b3b8-0981a9400607"
 21severity = "high"
 22tags = [
 23    "Domain: Endpoint",
 24    "OS: Windows",
 25    "Use Case: Threat Detection",
 26    "Tactic: Privilege Escalation",
 27    "Resources: Investigation Guide",
 28    "Use Case: Vulnerability",
 29    "Data Source: Elastic Defend",
 30    "Noise: Medium",
 31    "Performance: Normal",
 32    "Profile: Recommended",
 33    "Threat: Vulnerability Exploit",
 34    "Rule Type: Event Correlation (EQL)",
 35    "Platform: Windows",
 36    "Vuln: CVE-2021-41379",
 37]
 38timestamp_override = "event.ingested"
 39type = "eql"
 40
 41query = '''
 42process where host.os.type == "windows" and event.type == "start" and
 43    process.Ext.token.integrity_level_name : "System" and
 44    (
 45      (process.name : "elevation_service.exe" and
 46       not process.pe.original_file_name == "elevation_service.exe") or
 47      
 48      (process.name : "elevation_service.exe" and
 49       not process.code_signature.trusted == true) or
 50
 51      (process.parent.name : "elevation_service.exe" and
 52       process.name : ("rundll32.exe", "cmd.exe", "powershell.exe"))
 53    ) and
 54    not
 55    (
 56      process.name : "elevation_service.exe" and process.code_signature.trusted == true and
 57      process.pe.original_file_name == null
 58    )
 59'''
 60
 61note = """## Triage and analysis
 62
 63### Investigating Potential Privilege Escalation via InstallerFileTakeOver
 64
 65#### Possible investigation steps
 66
 67- Which alert path fired: a suspect service binary or a service-spawned child?
 68  - Focus: alert-local `process.name`, `process.executable`, `process.command_line`, `process.parent.executable`, and `process.Ext.token.integrity_level_name`.
 69  - Implication: escalate when SYSTEM "elevation_service.exe" runs outside "%ProgramFiles% or %ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\<version>\\elevation_service.exe" or starts "cmd.exe", "powershell.exe", or "rundll32.exe"; lower suspicion only for a genuine Edge service start with no shell child.
 70- Is the elevation service binary genuine Microsoft content?
 71  - Focus: compare service `process.executable`, `process.pe.original_file_name`, `process.hash.sha256`, `process.code_signature.subject_name`, and `process.code_signature.trusted`; for child alerts, recover the parent service start on `host.id` with `process.parent.entity_id` and compare those fields there.
 72  - Hint: if a child alert lacks parent hash or signer details, recover the parent service process start with entity or PID fallback. $investigate_0
 73  - Implication: escalate when original filename is not "elevation_service.exe", signer is not Microsoft, trust fails, or the same hash appears from a user-writable path; lower suspicion only when path, filename, signer, trust, and hash history fit the expected Microsoft Edge service.
 74- Does lineage show Windows Installer takeover rather than normal Edge servicing?
 75  - Focus: `process.parent.executable`, `process.parent.command_line`, `process.parent.code_signature.subject_name`, `process.parent.code_signature.trusted`, and broader process lineage when needed.
 76  - Implication: escalate when an MSI, temp, or user-session chain leads to the SYSTEM service or shell; lower suspicion when Microsoft-signed Edge installer or updater lineage starts the genuine service with servicing arguments and no shell.
 77- Do recovered file events show service overwrite or PoC staging artifacts?
 78  - Focus: if file telemetry exists, open host-scoped file events, then filter to the recovered service or child `process.entity_id`; if entity IDs are absent, use `host.id` plus service `process.pid` or `process.parent.pid` and the alert window. Review `file.path`, `file.Ext.original.path`, and writing `process.executable`. $investigate_2
 79  - Range: start 30 minutes before the alert because MSI administrative-install staging can precede service execution.
 80  - Implication: escalate when the Edge service path is overwritten or PoC artifacts such as the "microsoft plz" temp folder, temp MSI, or "elevation_service.exe" file creation cluster around the alert; treat those names as corroborators, not required evidence. Missing file telemetry is unresolved, not benign.
 81  - Hint: modified variants may omit PoC names; keep this centered on service replacement and MSI staging when names differ.
 82- What did the SYSTEM service or spawned child do next?
 83  - Focus: descendant process starts on the same `host.id` from `process.entity_id` or `process.parent.entity_id`, especially `process.name`, `process.command_line`, and `process.Ext.token.integrity_level_name`. $investigate_1
 84  - Implication: escalate when SYSTEM context launches credential-access, persistence, payload staging, or remote-execution tooling; keep scope near the privilege-escalation event only when the service or shell produces no follow-on SYSTEM activity.
 85- If local findings remain suspicious or unresolved, do related alerts show broader exploitation?
 86  - Focus: related alerts for the same `host.id` in the last 48 hours, especially service tampering, suspicious MSI, credential access, or follow-on execution. $investigate_3
 87  - Hint: compare `user.id` only when it identifies a non-SYSTEM actor; otherwise keep broadened review host-scoped and use lineage to avoid over-attributing the operator. $investigate_4
 88  - Implication: broaden response when the same host or user shows privilege-escalation or post-exploitation alerts; quiet related-alert review does not close unresolved local evidence.
 89- Escalate on identity mismatch, MSI/user lineage, service overwrite, SYSTEM shell, or follow-on activity; close only when all evidence fits genuine Microsoft Edge service identity with no shell behavior or verified validation/detonation; preserve artifacts and escalate when evidence is mixed or telemetry is missing.
 90
 91### False positive analysis
 92
 93- Authorized exploit validation, red-team work, detection-content testing, malware research, or incident-response detonation can trigger this rule on lab or disposable analysis hosts. Confirm `process.hash.sha256`, service `process.executable`, parent `process.parent.executable`, child `process.command_line`, recovered temp-artifact pattern, and bounded `host.id` cohort match the same test kit or analysis-host cohort. If change, test, or sandbox records are unavailable, require the same telemetry pattern across prior alerts from this rule before closing as benign.
 94- Before creating an exception, keep `process.hash.sha256`, `process.executable`, `process.parent.executable`, child `process.command_line`, `host.id`, and the recovered temp-artifact pattern stable across prior alerts from this rule. Avoid exceptions on `process.name`, `process.parent.name`, or "elevation_service.exe" alone because those values overlap real service abuse.
 95
 96### Response and remediation
 97
 98- If confirmed benign, reverse temporary containment and record the validation or analysis workflow that matched the alert, including the stable `process.hash.sha256`, service `process.executable`, parent `process.parent.executable`, child `process.command_line`, recovered artifact pattern, and bounded `host.id` cohort. Create an exception only after the same pattern recurs across prior alerts from this rule.
 99- If suspicious but unconfirmed, preserve the case export, process tree with service and child entity IDs, service binary and hash identity, spawned-shell command line, and recovered service-overwrite or temp-artifact timeline before containment or cleanup. Apply reversible containment first, such as heightened monitoring or host isolation when the asset role permits it; terminate the spawned shell only after capture, and escalate to isolation if follow-on SYSTEM activity or spread appears.
100- If confirmed malicious, use the preserved identity, lineage, artifact, and follow-on evidence to isolate the endpoint or escalate to the team that can contain it. Before replacing or deleting files, collect the overwritten service binary, temp MSI or recovered PoC artifacts, and spawned-shell timeline. Review related hosts and users for the same hash or service-path pattern, then restore the genuine Edge elevation service binary and remove only attacker payloads, persistence, or configuration changes identified during scoping.
101- Post-incident hardening: verify Windows Installer and Edge components are patched, restrict unnecessary MSI administrative-install paths where possible, retain process and file telemetry long enough to reconstruct service replacement, and record the service-path, temp-artifact, and child-shell pattern for future response.
102"""
103
104setup = """## Setup
105
106This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
107
108Setup instructions: https://ela.st/install-elastic-defend
109"""
110
111[rule.investigation_fields]
112field_names = [
113    "@timestamp",
114    "host.id",
115    "user.id",
116    "process.entity_id",
117    "process.pid",
118    "process.executable",
119    "process.command_line",
120    "process.pe.original_file_name",
121    "process.code_signature.subject_name",
122    "process.code_signature.trusted",
123    "process.hash.sha256",
124    "process.Ext.token.integrity_level_name",
125    "process.Ext.relative_file_creation_time",
126    "process.parent.executable",
127    "process.parent.command_line",
128]
129
130[transform]
131
132[[transform.investigate]]
133label = "Parent elevation service process start"
134description = ""
135providers = [
136  [
137    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
138    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
139    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
140  ],
141  [
142    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
143    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
144    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.parent.pid}}", valueType = "string" }
145  ]
146]
147relativeFrom = "now-1h"
148relativeTo = "now"
149
150[[transform.investigate]]
151label = "Child process starts from the alert process"
152description = ""
153providers = [
154  [
155    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
156    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
157    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
158  ],
159  [
160    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
161    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
162    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
163  ]
164]
165relativeFrom = "now-1h"
166relativeTo = "now"
167
168[[transform.investigate]]
169label = "File events on this host near the alert"
170description = ""
171providers = [
172  [
173    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
174    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
175  ]
176]
177relativeFrom = "now-1h"
178relativeTo = "now"
179
180[[transform.investigate]]
181label = "Alerts associated with the host"
182description = ""
183providers = [
184  [
185    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
186    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
187  ]
188]
189relativeFrom = "now-48h/h"
190relativeTo = "now"
191
192[[transform.investigate]]
193label = "Alerts associated with the user"
194description = ""
195providers = [
196  [
197    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
198    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
199  ]
200]
201relativeFrom = "now-48h/h"
202relativeTo = "now"
203
204[[rule.threat]]
205framework = "MITRE ATT&CK"
206
207[[rule.threat.technique]]
208id = "T1068"
209name = "Exploitation for Privilege Escalation"
210reference = "https://attack.mitre.org/techniques/T1068/"
211
212[[rule.threat.technique]]
213id = "T1574"
214name = "Hijack Execution Flow"
215reference = "https://attack.mitre.org/techniques/T1574/"
216
217[rule.threat.tactic]
218id = "TA0004"
219name = "Privilege Escalation"
220reference = "https://attack.mitre.org/tactics/TA0004/"
221
222[[rule.threat]]
223framework = "MITRE ATT&CK"
224
225[[rule.threat.technique]]
226id = "T1036"
227name = "Masquerading"
228reference = "https://attack.mitre.org/techniques/T1036/"
229
230[[rule.threat.technique.subtechnique]]
231id = "T1036.005"
232name = "Match Legitimate Resource Name or Location"
233reference = "https://attack.mitre.org/techniques/T1036/005/"
234
235[rule.threat.tactic]
236id = "TA0005"
237name = "Defense Evasion"
238reference = "https://attack.mitre.org/tactics/TA0005/"