Potential Escalation via Vulnerable MSI Repair

  1[metadata]
  2creation_date = "2024/09/12"
  3integration = ["endpoint", "sentinel_one_cloud_funnel", "m365_defender", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies when a browser process navigates to the Microsoft Help page followed by spawning an elevated process. This
 11may indicate a successful exploitation for privilege escalation abusing a vulnerable Windows Installer repair setup.
 12"""
 13from = "now-9m"
 14index = [
 15    "winlogbeat-*",
 16    "endgame-*",
 17    "logs-endpoint.events.process-*",
 18    "logs-windows.sysmon_operational-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-m365_defender.event-*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Potential Escalation via Vulnerable MSI Repair"
 25references = [
 26    "https://sec-consult.com/blog/detail/msi-installer-repair-to-system-a-detailed-journey/",
 27    "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38014",
 28]
 29risk_score = 73
 30rule_id = "043d80a3-c49e-43ef-9c72-1088f0c7b278"
 31severity = "high"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Privilege Escalation",
 37    "Data Source: Elastic Endgame",
 38    "Data Source: Elastic Defend",
 39    "Data Source: Sysmon",
 40    "Data Source: SentinelOne",
 41    "Data Source: Microsoft Defender XDR",
 42    "Resources: Investigation Guide",
 43    "Noise: Low",
 44    "Performance: Normal",
 45    "Profile: Recommended",
 46    "Threat: Living off the Land",
 47    "Threat: Vulnerability Exploit",
 48    "Rule Type: Event Correlation (EQL)",
 49    "Platform: Windows",
 50]
 51timestamp_override = "event.ingested"
 52type = "eql"
 53
 54query = '''
 55process where event.type == "start" and host.os.type == "windows" and
 56 user.domain : ("NT AUTHORITY", "AUTORITE NT", "AUTORIDADE NT") and
 57 process.parent.name : ("chrome.exe", "msedge.exe", "brave.exe", "whale.exe", "browser.exe", "dragon.exe", "vivaldi.exe",
 58                        "opera.exe", "iexplore", "firefox.exe", "waterfox.exe", "iexplore.exe", "tor.exe", "safari.exe") and
 59 process.parent.command_line : "*go.microsoft.com*"
 60'''
 61
 62note = """## Triage and analysis
 63
 64### Investigating Potential Escalation via Vulnerable MSI Repair
 65#### Possible investigation steps
 66
 67- What did the elevated browser parent launch?
 68  - Why: MSI repair abuse can expose a SYSTEM browser through a help-link redirect; a non-browser child marks the privilege-escalation boundary.
 69  - Focus: `process.parent.command_line`, `process.name`, `process.executable`, `process.command_line`, and `process.Ext.token.integrity_level_name`.
 70  - Implication: escalate when a Microsoft Help-tied browser launches a SYSTEM or high-integrity shell, script host, installer, admin utility, file manager, or user-writable binary; lower concern only when the command line shows a browser-internal role, path and signer match the parent browser family, and no non-browser child appears in the alert window.
 71- Does the lineage fit an MSI repair-to-help-link path?
 72  - Focus: `process.parent.entity_id`, `process.parent.pid`, surrounding `process.name`, and `process.command_line`.
 73  - Implication: escalate when ancestry or surrounding starts show MSI repair, installer custom actions, console activity, or an unexpected SYSTEM browser before the child; lower concern when the chain stays inside browser self-maintenance without repair, console, or custom-action ancestry.
 74  - Hint: recover the parent browser event first. If parentage is incomplete, inspect `process.Ext.ancestry`; if entity IDs are absent, use `host.id`, `process.parent.pid`, and a tight alert window. $investigate_0
 75- Is the child process identity expected for the host and signer?
 76  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.Ext.relative_file_creation_time`.
 77  - Implication: escalate when the child runs from a user-writable or temporary path, has a mismatched original file name, lacks a trusted signer, or was recently created; lower concern only when signer, path, age, and browser parent context all fit the same recognized component.
 78- What follow-on process activity came from the same SYSTEM browser or spawned child?
 79  - Focus: same-host starts from the browser `process.parent.entity_id` or child `process.entity_id`: `process.name`, `process.command_line`, and `process.Ext.token.integrity_level_name`.
 80  - Implication: escalate when the browser or child launches shells, scripts, persistence or administration tools, additional installers, or chained SYSTEM processes; keep scope local when activity stops at browser helpers with no privileged child chain.
 81  - Hint: prefer `host.id` plus parent or child `process.entity_id`; use `host.id`, `process.pid`, and a tight window only when entity IDs are absent.
 82    - $investigate_1
 83    - $investigate_2
 84- Does the user and session context support interactive exploitation?
 85  - Focus: `user.id`, `user.name`, `user.domain`, `process.Ext.authentication_id`, and `process.Ext.session_info.logon_type`.
 86  - Implication: escalate when a low-privileged or unexpected interactive session is tied to the SYSTEM browser-to-child chain; a pre-existing user browser usually breaks the SYSTEM child path, so a SYSTEM or high-integrity child tied to an interactive session is severity-changing. Lower concern only when process evidence maps to controlled repair validation or browser-helper behavior.
 87- Does process telemetry show the same SYSTEM-browser-to-tool pattern beyond this process instance?
 88  - Focus: same `process.parent.command_line` redirect fragment, suspicious `process.name` or `process.executable`, `user.id`, and `host.id` across recent starts.
 89  - Implication: broaden when recent starts show the same non-browser child pattern across unrelated hosts or users; keep response scoped when telemetry shows only this browser parent, child command line, and no repeated non-browser descendants.
 90  - Hint: run this pivot only if child intent, lineage, or session context remains suspicious or unresolved. $investigate_3
 91- Based on the evidence gathered, what disposition is supported?
 92  - Escalate on SYSTEM or high-integrity browser-to-tool execution, MSI repair lineage, suspicious child identity, interactive session linkage, or repeated scope; close only for same-browser helper behavior with no non-browser descendants or an authorized test whose process facts exactly match scope. Preserve evidence and escalate when child intent, lineage, or session context is mixed or incomplete.
 93
 94### False positive analysis
 95
 96- Browser helper, renderer, GPU, updater, or crash subprocesses can trigger after a SYSTEM browser opens a Microsoft Help link. Confirm a browser-internal role, same browser family, installed-browser path and signer, and no shell, installer, file manager, or admin tool from the same parent.
 97- Authorized MSI repair security validation is benign only when `@timestamp`, `host.id`, `user.id`, the SYSTEM browser parent command line, and child command line match the exact exercise; outside records may corroborate but not replace process facts.
 98- Build exceptions from the minimum confirmed workflow: browser family and signer, exact redirect parent context, expected child executable or command pattern, `host.id`, and tightly scoped test or managed-repair cohort. Avoid exceptions on `user.domain`, browser name, or redirect URL alone.
 99
100### Response and remediation
101
102- If confirmed benign, document the process evidence that proved the browser-helper or validation workflow, reverse any temporary containment, and create only the narrow exception described above if the same workflow recurs.
103- If suspicious but unconfirmed, preserve the alert and Timeline/export records for the browser parent, child, ancestor chain, host, and user. Record command lines, `process.entity_id`, `process.parent.entity_id`, `host.id`, `user.id`, and any visible MSI package or vulnerable-application names before containment or process termination.
104- Apply reversible containment first when findings remain suspicious: isolate the host if its business role allows, or restrict the affected account/session while preserving endpoint telemetry. Do not terminate the child process until its command line, parentage, and spawned descendants are recorded.
105- If confirmed malicious, contain the host and affected account based on the process lineage and session evidence, then terminate the malicious child and descendants after recording their identifiers. Remove only the payloads, repair artifacts, or configuration changes identified during the investigation.
106- Patch Windows Installer and the vulnerable application package involved in the repair path, verify that the affected OS has the relevant vendor security update for CVE-2024-38014, and repackage or disable repair flows that let low-privileged users reach elevated custom actions, console windows, or help-link execution.
107- Document the final evidence set, repair path, affected hosts, and any missing telemetry that limited certainty so future alerts can distinguish browser helper noise, authorized validation, and repeated exploitation."""
108
109setup = """## Setup
110
111This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
112
113Setup instructions: https://ela.st/install-elastic-defend
114
115### Additional data sources
116
117This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
118
119- [Microsoft Defender XDR](https://ela.st/m365-defender)
120- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
121- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
122"""
123
124[rule.investigation_fields]
125field_names = [
126    "@timestamp",
127    "host.id",
128    "user.id",
129    "process.entity_id",
130    "process.name",
131    "process.executable",
132    "process.command_line",
133    "process.code_signature.trusted",
134    "process.parent.entity_id",
135    "process.parent.name",
136    "process.parent.executable",
137    "process.parent.command_line",
138    "process.Ext.authentication_id",
139    "process.Ext.session_info.logon_type",
140    "process.Ext.token.integrity_level_name",
141]
142
143[transform]
144
145[[transform.investigate]]
146label = "SYSTEM browser parent process event"
147description = ""
148providers = [
149  [
150    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
151    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
152    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
153  ]
154]
155relativeFrom = "now-1h"
156relativeTo = "now"
157
158[[transform.investigate]]
159label = "Process starts from the SYSTEM browser parent"
160description = ""
161providers = [
162  [
163    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
164    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
165    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
166    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
167  ]
168]
169relativeFrom = "now-1h"
170relativeTo = "now"
171
172[[transform.investigate]]
173label = "Process starts from the launched child"
174description = ""
175providers = [
176  [
177    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
178    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
179    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
180    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
181  ]
182]
183relativeFrom = "now"
184relativeTo = "now"
185
186[[transform.investigate]]
187label = "Recent process starts with the same child executable"
188description = ""
189providers = [
190  [
191    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
192    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
193    { excluded = false, field = "process.executable", queryType = "phrase", value = "{{process.executable}}", valueType = "string" }
194  ]
195]
196relativeFrom = "now-48h/h"
197relativeTo = "now"
198
199[[rule.threat]]
200framework = "MITRE ATT&CK"
201
202[[rule.threat.technique]]
203id = "T1068"
204name = "Exploitation for Privilege Escalation"
205reference = "https://attack.mitre.org/techniques/T1068/"
206
207[rule.threat.tactic]
208id = "TA0004"
209name = "Privilege Escalation"
210reference = "https://attack.mitre.org/tactics/TA0004/"
211
212[[rule.threat]]
213framework = "MITRE ATT&CK"
214
215[[rule.threat.technique]]
216id = "T1218"
217name = "System Binary Proxy Execution"
218reference = "https://attack.mitre.org/techniques/T1218/"
219
220[[rule.threat.technique.subtechnique]]
221id = "T1218.007"
222name = "Msiexec"
223reference = "https://attack.mitre.org/techniques/T1218/007/"
224
225[rule.threat.tactic]
226id = "TA0005"
227name = "Defense Evasion"
228reference = "https://attack.mitre.org/tactics/TA0005/"