UAC Bypass Attempt via Privileged IFileOperation COM Interface

 1[metadata]
 2creation_date = "2020/10/27"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to
11stealthily execute code with elevated permissions.
12"""
13from = "now-9m"
14index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
15language = "eql"
16license = "Elastic License v2"
17name = "UAC Bypass Attempt via Privileged IFileOperation COM Interface"
18references = [
19    "https://github.com/hfiref0x/UACME",
20    "https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies",
21]
22risk_score = 73
23rule_id = "5a14d01d-7ac8-4545-914c-b687c2cf66b3"
24setup = """## Setup
25
26If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
27events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
28Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
29`event.ingested` to @timestamp.
30For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
31"""
32severity = "high"
33tags = [
34    "Domain: Endpoint",
35    "OS: Windows",
36    "Use Case: Threat Detection",
37    "Tactic: Privilege Escalation",
38    "Tactic: Defense Evasion",
39    "Data Source: Elastic Endgame",
40    "Data Source: Elastic Defend",
41    "Data Source: Sysmon",
42]
43timestamp_override = "event.ingested"
44type = "eql"
45
46query = '''
47file where host.os.type == "windows" and event.type : "change" and process.name : "dllhost.exe" and
48  /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */
49  file.name : ("wow64log.dll", "comctl32.dll", "DismCore.dll", "OskSupport.dll", "duser.dll", "Accessibility.ni.dll") and
50  /* has no impact on rule logic just to avoid OS install related FPs */
51  not file.path : ("C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\WinSxS\\*")
52'''
53
54
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1548"
59name = "Abuse Elevation Control Mechanism"
60reference = "https://attack.mitre.org/techniques/T1548/"
61[[rule.threat.technique.subtechnique]]
62id = "T1548.002"
63name = "Bypass User Account Control"
64reference = "https://attack.mitre.org/techniques/T1548/002/"
65
66
67
68[rule.threat.tactic]
69id = "TA0004"
70name = "Privilege Escalation"
71reference = "https://attack.mitre.org/tactics/TA0004/"
72[[rule.threat]]
73framework = "MITRE ATT&CK"
74[[rule.threat.technique]]
75id = "T1548"
76name = "Abuse Elevation Control Mechanism"
77reference = "https://attack.mitre.org/techniques/T1548/"
78[[rule.threat.technique.subtechnique]]
79id = "T1548.002"
80name = "Bypass User Account Control"
81reference = "https://attack.mitre.org/techniques/T1548/002/"
82
83
84[[rule.threat.technique]]
85id = "T1574"
86name = "Hijack Execution Flow"
87reference = "https://attack.mitre.org/techniques/T1574/"
88[[rule.threat.technique.subtechnique]]
89id = "T1574.002"
90name = "DLL Side-Loading"
91reference = "https://attack.mitre.org/techniques/T1574/002/"
92
93
94
95[rule.threat.tactic]
96id = "TA0005"
97name = "Defense Evasion"
98reference = "https://attack.mitre.org/tactics/TA0005/"