attack.privilege_escalation

Explorer UAC Bypass Via /NOUACCHECK Parameter

Aug 10, 2024 · attack.privilege_escalation attack.T1548.002 ·

Detects possible attempt to circumvent the User Account Control (UAC) by executing Windows Explorer to spawn a command line interpreter process without triggering UAC prompts.

KrbRelayUp local privilege escalation.

Aug 10, 2024 · attack.privilege_escalation attack.t1068 ·

Share on:

Detecting possible successful exploitation using tools such as KrbRelayUp AD environment

SamAccountName Spoofing and Domain Controller Impersonation

Aug 10, 2024 · attack.privilege_escalation attack.t1068 ·

Share on:

'This technique is to detect exploitation chain of CVE-2021-42287 (samAccountName Spoofing) and CVE-2021-42278 (Domain Controller Impersonation). It is looking into event 4781 for evidence of a new computer account creation and account rename that matches the name of a domain controller account without ending in "$". Computer account names always end with $ and a change like this is highly unusual. Immediately after the 4781 event, a Kerberos Ticket Granting Ticket (TGT) must be requested on behalf of the newly created and renamed computer account. A computer account name event will occur before this TGT request. Putting everything together, we may use events 4781 and 4768 to look for a series of events in which the new computer account on event 4781 matches the requested account on event 4768. NOTE-- On selection2, the TargetUserName should equal to NewTargetUserName. I have left it as a placeholder but this should change dependingon the backend you are translating the query to. Splunk Example-- | eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) | transaction RenamedComputerAccount endswith=(EventCode=4781)'

AppInit DLL Installation

Mar 26, 2024 · attack.privilege_escalation attack.persistence attack.t1546 attack.t1546.010 ·

Share on:

One persistence mechanism used by some variations of SmashJacker was an AppInit DLL. It would use a reg.exe command to create appropriate Windows Registry keys for persistence. Part of the RedCanary 2024 Threat Detection Report.

Non-depmod Process Modifying modules.dep

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects unusual process modifying the modules.dep file. The modules.dep and modules.dep.bin files should only be modified by the depmod utility. Part of the RedCanary 2024 Threat Detection Report.

Non-Microsoft App Package Installation Process

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·

Share on:

Detects app package installation processes where the app is not a Microsoft app based on the publisher ID. Part of the RedCanary 2024 Threat Detection Report.

Package Support Framework (PSF) Advanced Installer Processes

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·

Share on:

Detects app package installation processes where legitimate software is included in an MSIX package, but a malicious PowerShell script may execute beforehand by employing the Package Support Framework (PSF). In these cases, the MSIX package includes the malicious script, which is executed as specified in an included config.json file. Part of the RedCanary 2024 Threat Detection Report.

PowerShell Startup Folder Persistence

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.001 ·

Share on:

Yellow Cockatoo Windows Startup folder for persistence. Not unique to Yellow Cockatoo, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL. Part of the RedCanary 2024 Threat Detection Report.

Shells Modifying Files in Known Linux Kernel Modules Directories

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects configuration files being written to specific directories that are searched when looking for loadable Linux Kernel Modules (LKM). Part of the RedCanary 2024 Threat Detection Report.

Systemd Loading a Linux Kernel Module Using insmod

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects the systemd process running commands that would load a Linux Kernel Modules. Part of the RedCanary 2024 Threat Detection Report.

Systemd Loading a Linux Kernel Module Using modprobe

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects the systemd process loading a Linux Kernel Modules using modprobe. Part of the RedCanary 2024 Threat Detection Report.

QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Feb 23, 2024 · attack.persistence attack.privilege_escalation attack.t1053.005 ·

Share on:

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

QBot scheduled task REGSVR32 with C$ image path

Feb 23, 2024 · attack.persistence attack.privilege_escalation attack.t1053.005 ·

Share on:

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Network Connections Where There Should Not Be (Notepad)

Sep 1, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for network connections from notepad. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.

Potential Gamarue DLL Filename (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055.001 ·

Share on:

Detects Gamarue DLL filename in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Powershell Injecting Into Anything (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.

Process Executing Sans Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects processes running without command lines, which can indicate process injection. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Network Connections (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects notepad making network connections, a potential process injection signal. Part of the RedCanary 2023 Threat Detection Report.

CVE-2021-3156 Exploitation Attempt

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing required to trigger the heap-based buffer overflow.

CVE-2021-3156 Exploitation Attempt Bruteforcing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing. required to trigger the heap-based buffer overflow.

Detection of Possible Rotten Potato

Apr 21, 2023 · attack.privilege_escalation attack.t1134 attack.t1134.002 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Disabled Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple disabled domain accounts from a single source system using the Kerberos protocol.

Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Invalid Users Failing To Authenticate From Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.

Invalid Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the Kerberos protocol.

Malicious Service Installations

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1003 attack.t1035 attack.t1050 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Meterpreter or Cobalt Strike Getsystem Service Installation

Apr 21, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

MSI Spawned Cmd and Powershell Spawned Processes

Apr 21, 2023 · attack.privilege_escalation attack.t1548.002 ·

Share on:

This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes

Multiple Users Failing to Authenticate from Single Process

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple accounts from a single process on the system.

Multiple Users Remotely Failing To Authenticate From Single Source

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects a source system failing to authenticate against a remote host with multiple users.

OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Password Spraying via Explicit Credentials

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects a single user failing to authenticate to multiple users using explicit credentials.

Valid Users Failing to Authenticate From Single Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.

Valid Users Failing to Authenticate from Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.

Windows Kernel and 3rd-Party Drivers Exploits Token Stealing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level

Suspicious Commands by SQL Server

Jan 8, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious commands created from sqlservr process.

PowerShell Injecting into Other Process

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for process access activity where PowerShell is accessing any other processes. Inspired by the 2022 Red Canary Threat Detection report.

Process Execution sans Command Lines

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for process execution with no command line arguments, which may indicate process injection. Inspired by the 2022 Red Canary Threat Detection report.