Privilege Escalation via Windir Environment Variable

 1[metadata]
 2creation_date = "2020/11/26"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known
11primitive that is often combined with other vulnerabilities to elevate privileges.
12"""
13from = "now-9m"
14index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
15language = "eql"
16license = "Elastic License v2"
17name = "Privilege Escalation via Windir Environment Variable"
18references = ["https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html"]
19risk_score = 73
20rule_id = "d563aaba-2e72-462b-8658-3e5ea22db3a6"
21severity = "high"
22tags = [
23    "Domain: Endpoint",
24    "OS: Windows",
25    "Use Case: Threat Detection",
26    "Tactic: Privilege Escalation",
27    "Data Source: Elastic Endgame",
28    "Data Source: Elastic Defend",
29    "Data Source: Sysmon",
30]
31timestamp_override = "event.ingested"
32type = "eql"
33
34query = '''
35registry where host.os.type == "windows" and registry.path : (
36    "HKEY_USERS\\*\\Environment\\windir",
37    "HKEY_USERS\\*\\Environment\\systemroot",
38    "HKU\\*\\Environment\\windir",
39    "HKU\\*\\Environment\\systemroot",
40    "\\REGISTRY\\USER\\*\\Environment\\windir",
41    "\\REGISTRY\\USER\\*\\Environment\\systemroot"
42    ) and
43 not registry.data.strings : ("C:\\windows", "%SystemRoot%")
44'''
45
46
47[[rule.threat]]
48framework = "MITRE ATT&CK"
49[[rule.threat.technique]]
50id = "T1574"
51name = "Hijack Execution Flow"
52reference = "https://attack.mitre.org/techniques/T1574/"
53[[rule.threat.technique.subtechnique]]
54id = "T1574.007"
55name = "Path Interception by PATH Environment Variable"
56reference = "https://attack.mitre.org/techniques/T1574/007/"
57
58
59
60[rule.threat.tactic]
61id = "TA0004"
62name = "Privilege Escalation"
63reference = "https://attack.mitre.org/tactics/TA0004/"