Suspicious Elevated System Shell

  1title: Suspicious Elevated System Shell
  2id: 178e615d-e666-498b-9630-9ed363038101
  3status: experimental
  4description: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges.
  5references:
  6    - https://github.com/Wh04m1001/SysmonEoP
  7author: frack113, Tim Shelton (update fp)
  8date: 2022/12/05
  9modified: 2023/09/14
 10tags:
 11    - attack.privilege_escalation
 12    - attack.defense_evasion
 13    - attack.execution
 14    - attack.t1059
 15logsource:
 16    product: windows
 17    category: process_creation
 18detection:
 19    selection_shell:
 20        - Image|endswith:
 21            - '\powershell.exe'
 22            - '\pwsh.exe'
 23            - '\cmd.exe'
 24        - OriginalFileName:
 25            - 'PowerShell.EXE'
 26            - 'pwsh.dll'
 27            - 'Cmd.Exe'
 28    selection_user:
 29        User|contains: # covers many language settings
 30            - 'AUTHORI'
 31            - 'AUTORI'
 32        LogonId: '0x3e7'
 33    filter_generic:
 34        # Example 1:
 35        #   C:\Program Files\erl-23.2\erts-11.1.4\bin\erl.exe" -service_event ErlSrv_RabbitMQ -nohup -sname rabbit@localhost -s rabbit boot -boot start_sasl +W w +MBas ageffcbf +MHas ageffcbf +MBlmbcs 512 +MHlmbcs 512 +MMmcs 30 +P 1048576 +t 5000000 +stbt db +zdbbl 128000 +sbwt none +sbwtdcpu none +sbwtdio none -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672 -lager crash_log false -lager handlers []
 36        # Example 2:
 37        #   ParentImage: C:\Program Files (x86)\Varonis\DatAdvantage\GridCollector\VrnsRealTimeAlertsSvc.exe" /appid 000000ad-cb03-500b-9459-c46d000000ad
 38        #   CommandLine: C:\Windows\system32\cmd.exe /c C:\Program Files "(x86)\Varonis\DatAdvantage\GridCollector\handle_scopes.cmd C:\Collector" Working Share\VaronisWorkDirectoryCollector
 39        ParentImage|startswith:
 40            - 'C:\Windows\System32\'
 41            - 'C:\Program Files (x86)\'
 42            - 'C:\Program Files\'
 43        Image|endswith:
 44            - '\cmd.exe'
 45            - '\powershell.exe'
 46    filter_manageengine:
 47        # Example:
 48        #   ParentImage: C:/ManageEngine/ADManager Plus/pgsql/bin/postgres.exe" --forkarch 5380
 49        #   CommandLine: C:\Windows\system32\cmd.exe /c "IF EXIST archive.bat (archive.bat pg_wal\000000010000008E000000EA 000000010000008E000000EA)
 50        ParentImage: 'C:\ManageEngine\ADManager Plus\pgsql\bin\postgres.exe'
 51        Image|endswith: '\cmd.exe'
 52    filter_citrix:
 53        ParentImage|startswith: 'C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\'
 54        ParentImage|endswith: '\CitrixReceiverUpdater.exe'
 55        Image|endswith: '\cmd.exe'
 56    filter_asgard:
 57        CommandLine|startswith: 'C:\WINDOWS\system32\cmd.exe /c "'
 58        CurrentDirectory|contains: 'C:\WINDOWS\Temp\asgard2-agent\'
 59    filter_dell_update:
 60        ParentImage|startswith: 'C:\Windows\Temp'
 61        ParentImage|endswith: '\invcol.exe'
 62        ParentCommandLine|contains: 'C:\ProgramData\Dell\UpdateService\'
 63        Image|endswith: '\cmd.exe'
 64    filter_compattelrunner:
 65        ParentImage|startswith:
 66            - 'C:\Windows\System32'
 67            - 'C:\Windows\WinSxS\'
 68        ParentImage|endswith: '\CompatTelRunner.exe'
 69        ParentCommandLine|startswith: 'C:\Windows\system32\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun'
 70    filter_ibm_spectrumprotect:
 71        ParentImage|startswith: 'C:\IBM\SpectrumProtect\webserver\scripts\'
 72        CommandLine|contains: 'C:\IBM\SpectrumProtect\webserver\scripts\'
 73    filter_msiexec:
 74        ParentImage: 'C:\Windows\SysWOW64\msiexec.exe'
 75        ParentCommandLine|startswith: 'C:\Windows\syswow64\MsiExec.exe -Embedding'
 76        CommandLine|contains: '\RegisterMicrosoftUpdate.ps1'
 77    filter_empty_parent_1:
 78        # https://answers.microsoft.com/en-us/windows/forum/all/res-and-inf-powershell-commands/793736ee-94bd-424f-811c-35a425e28832
 79        # Most probably SetupHost.exe during Windows updates/upgrades; See comment on rule id: f4bbd493-b796-416e-bbf2-121235348529
 80        CommandLine|startswith:
 81            - 'powershell.exe -ExecutionPolicy Restricted -Command  $res = 0; '
 82            - 'powershell.exe -ExecutionPolicy Restricted -Command Write-Host '
 83        CommandLine|endswith:
 84            - "Write-Host 'Final result:', $Res;"
 85            - 'Write-Host "Final result:", $res'
 86            - "Write-Host 'Final result: 1';"
 87    filter_empty_parent_2:
 88        Image|endswith: '\cmd.exe'
 89        CommandLine|contains: '/d /c C:\Windows\system32\silcollector.cmd'
 90    filter_empty_parent_3:
 91        Image|endswith: '\cmd.exe'
 92        CommandLine|endswith:
 93            - 'cmd.exe /c btool server list replication_port --no-log'
 94            - 'cmd.exe /c btool server list general --no-log'
 95    filter_empty_parent_4: # seen on an SCCM server
 96        Image|endswith: '\cmd.exe'
 97        CommandLine|contains: 'C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64'
 98    filter_empty_parent_5:
 99        Image: 'C:\Windows\System32\cmd.exe'
100        CommandLine: 'C:\Windows\system32\cmd.exe /c PAUSE'
101    condition: all of selection_* and not 1 of filter_*
102falsepositives:
103    - Unknown
104level: high