attack.privilege_escalation

HackTool - WinPwn Execution

Dec 4, 2023 · attack.credential_access attack.defense_evasion attack.discovery attack.execution attack.privilege_escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

HackTool - WinPwn Execution - ScriptBlock

Dec 4, 2023 · attack.credential_access attack.defense_evasion attack.discovery attack.execution attack.privilege_escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Function Call From Undocumented COM Interface EditionUpgradeManager

Dec 4, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

HackTool - winPEAS Execution

Dec 4, 2023 · attack.privilege_escalation attack.t1082 attack.t1087 attack.t1046 ·

Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Malware Shellcode in Verclsid Target Process

Dec 4, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 detection.emerging_threats ·

Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Potential Process Hollowing Activity

Dec 4, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.012 ·

Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Potential Shellcode Injection

Dec 4, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects potential shellcode injection used by tools such as Metasploit's migrate and Empire's psinject

Cisco BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Cisco LDP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Github New Secret Created

Dec 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1078.004 ·

Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Github Self Hosted Runner Changes Detected

Dec 1, 2023 · attack.impact attack.discovery attack.collection attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

HackTool - SysmonEOP Execution

Dec 1, 2023 · cve.2022.41120 attack.t1068 attack.privilege_escalation ·

Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Huawei BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Juniper BGP Missing MD5

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Nimbuspwn Exploitation

Dec 1, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Dec 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation

PwnKit Local Privilege Escalation

Dec 1, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Renamed Mavinject.EXE Execution

Dec 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Suspicious Shells Spawn by Java Utility Keytool

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Uncommon One Time Only Scheduled Task At 00:00

Dec 1, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 ·

Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

VsCode Powershell Profile Modification

Dec 1, 2023 · attack.persistence attack.privilege_escalation attack.t1546.013 ·

Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Potential Persistence Via Netsh Helper DLL

Nov 28, 2023 · attack.privilege_escalation attack.persistence attack.t1546.007 attack.s0108 ·

Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Lazarus APT DLL Sideloading Activity

Nov 28, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging_threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

CobaltStrike Named Pipe Patterns

Nov 27, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 stp.1k ·

Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Potential Access Token Abuse

Nov 27, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1134.001 stp.4u ·

Share on:

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Scheduled Task Creation

Nov 27, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·

Share on:

Detects the creation of scheduled tasks in user session

Enabling COR Profiler Environment Variables

Nov 27, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.012 ·

Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Remote Thread Creation By Uncommon Source Image

Nov 15, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1055 ·

Share on:

Detects uncommon processes creating remote threads

Suspicious Shim Database Installation via Sdbinst.EXE

Nov 15, 2023 · attack.persistence attack.privilege_escalation attack.t1546.011 ·

Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Shell Process Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Suspicious Processes Spawned by Java.EXE

Nov 10, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Potential Persistence Via Security Descriptors - ScriptBlock

Nov 2, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Service Installed By Unusual Client - Security

Nov 2, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Service Installed By Unusual Client - System

Nov 2, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Suspicious SQL Query

Nov 2, 2023 · attack.exfiltration attack.initial_access attack.privilege_escalation attack.t1190 attack.t1505.001 ·

Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Win Susp Computer Name Containing Samtheadmin

Nov 2, 2023 · cve.2021.42278 cve.2021.42287 attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

App Role Added

Oct 28, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 ·

Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Impossible Travel

Oct 28, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Oct 28, 2023 · attack.lateral_movement attack.privilege_escalation attack.persistence attack.t1546.003 ·

Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Oct 28, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

PowerShell Profile Modification

Oct 28, 2023 · attack.persistence attack.privilege_escalation attack.t1546.013 ·

Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Suspicious Sysmon as Execution Parent

Oct 28, 2023 · attack.privilege_escalation attack.t1068 cve.2022.41120 detection.emerging_threats ·

Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Diamond Sleet APT Scheduled Task Creation

Oct 28, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 detection.emerging_threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Potential System DLL Sideloading From Non System Locations

Oct 28, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.)

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Oct 26, 2023 · attack.execution attack.privilege_escalation attack.resource_development attack.t1587 cve.2021.1675 detection.emerging_threats ·

Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

CVE-2022-24527 Microsoft Connected Cache LPE

Oct 26, 2023 · attack.privilege_escalation attack.t1059.001 cve.2022.24527 detection.emerging_threats ·

Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Exploitation Indicators Of CVE-2023-20198

Oct 26, 2023 · attack.privilege_escalation attack.initial_access detection.emerging_threats ·

Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Oct 26, 2023 · attack.privilege_escalation attack.t1068 detection.emerging_threats ·

Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Remote Thread Creation In Uncommon Target Image

Oct 23, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.003 ·

Share on:

Detects uncommon target processes for remote thread creation

Abused Debug Privilege by Arbitrary Parent Processes

Oct 18, 2023 · attack.privilege_escalation attack.t1548 ·

Share on:

Detection of unusual child processes by different system processes

Always Install Elevated MSI Spawned Cmd And Powershell

Oct 18, 2023 · attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

AWS Glue Development Endpoint Activity

Oct 18, 2023 · attack.privilege_escalation ·

Share on:

Detects possible suspicious glue development endpoint activity.

Azure Kubernetes CronJob

Oct 18, 2023 · attack.persistence attack.t1053.003 attack.privilege_escalation attack.execution ·

Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Creation Of Non-Existent System DLL

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects the creation of system dlls that are not present on the system. Usually to achieve dll hijacking

DotNet CLR DLL Loaded By Scripting Applications

Oct 18, 2023 · attack.execution attack.privilege_escalation attack.t1055 ·

Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Elevated System Shell Spawned

Oct 18, 2023 · attack.privilege_escalation attack.defense_evasion attack.execution attack.t1059 ·

Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges.

HackTool - CoercedPotato Execution

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

HackTool - SharpImpersonation Execution

Oct 18, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

HackTool - SharpUp PrivEsc Tool Execution

Oct 18, 2023 · attack.privilege_escalation attack.t1615 attack.t1569.002 attack.t1574.005 ·

Share on:

Detects the use of SharpUp, a tool for local privilege escalation

HackTool - UACMe Akagi Execution

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Malicious Named Pipe Created

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Oct 18, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Meterpreter or Cobalt Strike Getsystem Service Installation - System

Oct 18, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

New PDQDeploy Service - Server Side

Oct 18, 2023 · attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

OMIGOD HTTP No Authentication RCE

Oct 18, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.lateral_movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·

Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Password Provided In Command Line Of Net.EXE

Oct 18, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

Potential Azure Browser SSO Abuse

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.002 ·

Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Potential CVE-2021-41379 Exploitation Attempt

Oct 18, 2023 · attack.privilege_escalation attack.t1068 cve.2021.41379 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Potential ShellDispatch.DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Potential WWlib.DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "wwlib.dll"

Powershell WMI Persistence

Oct 18, 2023 · attack.privilege_escalation attack.t1546.003 ·

Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

PUA - AdvancedRun Execution

Oct 18, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·

Share on:

Detects the execution of AdvancedRun utility

PUA - AdvancedRun Suspicious Execution

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1134.002 ·

Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

PUA - Process Hacker Execution

Oct 18, 2023 · attack.defense_evasion attack.discovery attack.persistence attack.privilege_escalation attack.t1622 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors regularly abuse it to manipulate system processes.

PUA - System Informer Execution

Oct 18, 2023 · attack.persistence attack.privilege_escalation attack.discovery attack.defense_evasion attack.t1082 attack.t1564 attack.t1543 ·

Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

RottenPotato Like Attack Pattern

Oct 18, 2023 · attack.privilege_escalation attack.credential_access attack.t1557.001 ·

Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Suspect Svchost Activity

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Suspicious SYSTEM User Process Creation

Oct 18, 2023 · attack.credential_access attack.defense_evasion attack.privilege_escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Third Party Software DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

UAC Bypass via Event Viewer

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects UAC bypass method using Windows event viewer

User Added To Admin Group Via Dscl

Oct 18, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "dscl"

User Added To Admin Group Via DseditGroup

Oct 18, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Oct 18, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1558.003 ·

Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Vulnerable HackSys Extreme Vulnerable Driver Load

Oct 18, 2023 · attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

WMI Persistence

Oct 18, 2023 · attack.persistence attack.privilege_escalation attack.t1546.003 ·

Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Abuse of Service Permissions to Hide Services Via Set-Service

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Abuse of Service Permissions to Hide Services Via Set-Service - PS

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Application AppID Uri Configuration Changes

Oct 17, 2023 · attack.persistence attack.credential_access attack.privilege_escalation attack.t1552 attack.t1078.004 ·

Share on:

Detects when a configuration change is made to an applications AppID URI.

Application URI Configuration Changes

Oct 17, 2023 · attack.t1528 attack.t1078.004 attack.persistence attack.credential_access attack.privilege_escalation ·

Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Application Using Device Code Authentication Flow

Oct 17, 2023 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Oct 17, 2023 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Audit CVE Event

Oct 17, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Changes to Device Registration Policy

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1484 ·

Share on:

Monitor and alert for changes to the device registration policy.

Changes To PIM Settings

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1078.004 ·

Share on:

Detects when changes are made to PIM roles

DiagTrackEoP Default Login Username

Oct 17, 2023 · attack.privilege_escalation ·

Share on:

Detects the default "UserName" used by the DiagTrackEoP POC

DLL Search Order Hijackig Via Additional Space in Path

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.002 ·

Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

DLL Sideloading Of ShellChromeAPI.DLL

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

KDC RC4-HMAC Downgrade CVE-2022-37966

Oct 17, 2023 · attack.privilege_escalation ·

Share on:

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

KrbRelayUp Attack Pattern

Oct 17, 2023 · attack.privilege_escalation attack.credential_access ·

Share on:

Detects logon events that have characteristics of events generated during an attack with KrbRelayUp and the like

KrbRelayUp Service Installation

Oct 17, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Malicious DLL File Dropped in the Teams or OneDrive Folder

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.002 ·

Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file (“iphlpapi.dll”) is sideloaded

Mavinject Inject DLL Into Running Process

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.001 attack.t1218.013 ·

Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Modify Group Policy Settings

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Modify Group Policy Settings - ScriptBlockLogging

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Moriya Rootkit - System

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

New Kernel Driver Via SC.EXE

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

New PDQDeploy Service - Client Side

Oct 17, 2023 · attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

OMIGOD SCX RunAsProvider ExecuteScript

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

PIM Alert Setting Changes To Disabled

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects when PIM alerts are set to disabled.

PIM Approvals And Deny Elevation

Oct 17, 2023 · attack.privilege_escalation attack.t1078.004 ·

Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Potential DLL Sideloading Via ClassicExplorer32.dll

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Potential DLL Sideloading Via comctl32.dll

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Potential DLL Sideloading Via JsSchHlp

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Potential Privilege Escalation Attempt Via .Exe.Local Technique

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation ·

Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Potential Privilege Escalation Using Symlink Between Osk and Cmd

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1546.008 ·

Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Privileged Account Creation

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1078.004 ·

Share on:

Detects when a new admin is created.

Service DACL Abuse To Hide Services Via Sc.EXE

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·

Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Service Installation in Suspicious Folder

Oct 17, 2023 · attack.persistence attack.privilege_escalation car.2013-09-005 attack.t1543.003 ·

Share on:

Detects service installation in suspicious folder appdata

Sliver C2 Default Service Installation

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Sticky Key Like Backdoor Usage - Registry

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·

Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Sudo Privilege Escalation CVE-2019-14287

Oct 17, 2023 · attack.privilege_escalation attack.t1068 attack.t1548.003 cve.2019.14287 ·

Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Sudo Privilege Escalation CVE-2019-14287 - Builtin

Oct 17, 2023 · attack.privilege_escalation attack.t1068 attack.t1548.003 cve.2019.14287 ·

Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Suspicious GetTypeFromCLSID ShellExecute

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1546.015 ·

Share on:

Detects suspicious Powershell code that execute COM Objects

Suspicious New Service Creation

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Suspicious Processes Spawned by WinRM

Oct 17, 2023 · attack.t1190 attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Suspicious RunAs-Like Flag Combination

Oct 17, 2023 · attack.privilege_escalation ·

Share on:

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Suspicious Scheduled Task Creation

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·

Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Suspicious Scheduled Task Update

Oct 17, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·

Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Suspicious ScreenSave Change by Reg.exe

Oct 17, 2023 · attack.privilege_escalation attack.t1546.002 ·

Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·

Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Suspicious Service Installation Script

Oct 17, 2023 · attack.persistence attack.privilege_escalation car.2013-09-005 attack.t1543.003 ·

Share on:

Detects suspicious service installation scripts

Triple Cross eBPF Rootkit Execve Hijack

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

UAC Bypass Using EventVwr

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the pattern of a UAC bypass using Windows Event Viewer

UAC Bypass Using IDiagnostic Profile

Oct 17, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IDiagnostic Profile - File

Oct 17, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using Iscsicpl - ImageLoad

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

UAC Bypass via ICMLuaUtil

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

UAC Bypass via Windows Firewall Snap-In Hijack

Oct 17, 2023 · attack.privilege_escalation attack.t1548 ·

Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

User Added To Privilege Role

Oct 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1078.004 ·

Share on:

Detects when a user is added to a privileged role.

User Added To Root/Sudoers Group Using Usermod

Oct 17, 2023 · attack.privilege_escalation attack.persistence ·

Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

User State Changed From Guest To Member

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.t1078.004 ·

Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Users Added to Global or Device Admin Roles

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1078.004 ·

Share on:

Monitor and alert for users added to device admin roles.

VMGuestLib DLL Sideload

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Vulnerable WinRing0 Driver Load

Oct 17, 2023 · attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Windows Spooler Service Suspicious Binary Load

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574 cve.2021.1675 cve.2021.34527 ·

Share on:

Detect DLL Load from Spooler Service backup folder

App Granted Privileged Delegated Or App Permissions

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 ·

Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

AWS Attached Malicious Lambda Layer

Oct 12, 2023 · attack.privilege_escalation ·

Share on:

Detects when an user attached a Lambda layer to an existing function to override a library that is in use by the function, where their malicious code could utilize the function's IAM role for AWS API calls. This would give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

AWS Root Credentials

Oct 12, 2023 · attack.privilege_escalation attack.t1078.004 ·

Share on:

Detects AWS root account usage

AWS STS AssumeRole Misuse

Oct 12, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

AWS STS GetSessionToken Misuse

Oct 12, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

AWS Suspicious SAML Activity

Oct 12, 2023 · attack.initial_access attack.t1078 attack.lateral_movement attack.t1548 attack.privilege_escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Google Cloud Kubernetes CronJob

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.execution ·

Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

User Added to an Administrator's Azure AD Role

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 attack.t1078 ·

Share on:

User Added to an Administrator's Azure AD Role

HackTool - CoercedPotato Named Pipe Creation

Oct 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

HackTool - EfsPotato Named Pipe Creation

Oct 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Certificate Use With No Strong Mapping

Oct 11, 2023 · attack.privilege_escalation ·

Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

COM Hijack via Sdclt

Oct 4, 2023 · attack.privilege_escalation attack.t1546 attack.t1548 ·

Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Malicious Driver Load

Oct 4, 2023 · attack.privilege_escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known malicious drivers by hash value

Malicious Driver Load By Name

Oct 4, 2023 · attack.privilege_escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known malicious drivers via their names only.

Potentially Suspicious Event Viewer Child Process

Oct 4, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Vulnerable Driver Load

Oct 4, 2023 · attack.privilege_escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known vulnerable drivers by hash value

Vulnerable Driver Load By Name

Oct 4, 2023 · attack.privilege_escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known vulnerable drivers via their names only.

Service Registry Key Read Access Request

Sep 29, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.011 ·

Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Invalid PIM License

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Roles Activated Too Frequently

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when the same privilege role has multiple activations by the same user.

Roles Activation Doesn't Require MFA

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when a privilege role can be activated without performing mfa.

Roles Are Not Being Used

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Roles Assigned Outside PIM

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Stale Accounts In A Privileged Role

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies when an account hasn't signed in during the past n number of days.

Too Many Global Admins

Sep 14, 2023 · attack.t1078 attack.persistence attack.privilege_escalation ·

Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Azure AD Threat Intelligence

Sep 11, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

VMMap Signed Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

VMMap Unsigned Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Activity From Anonymous IP Address

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Atypical Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

New Country

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Suspicious Browser Activity

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Unfamiliar Sign-In Properties

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Network Connections Where There Should Not Be (Notepad)

Sep 1, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for network connections from notepad. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

HackTool - CrackMapExec Execution

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.credential_access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Suspicious Child Process Of Wermgr.EXE

Aug 28, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

User Added To Admin Group Via Sysadminctl

Aug 22, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Potential CVE-2023-21554 QueueJumper Exploitation

Aug 18, 2023 · attack.privilege_escalation attack.execution cve.2023.21554 detection.emerging_threats ·

Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Unsigned Mfdetours.DLL Sideloading

Aug 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Bypass UAC Using DelegateExecute

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

Bypasses User Account Control using a fileless method

Bypass UAC Using SilentCleanup Task

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC

CobaltStrike Service Installations in Registry

Aug 17, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_cobaltstrike_service_installs.yml) In some SIEM you can catch those events also in HKLM\System\ControlSet001\Services or HKLM\System\ControlSet002\Services, however, this rule is based on a regular sysmon's events.

Disable UAC Using Registry

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to disable User Account Control (UAC) by changing its registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0

Modify User Shell Folders Startup Value

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.001 ·

Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

ServiceDll Hijack

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Set TimeProviders DllName

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.003 ·

Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Suspicious Printer Driver Empty Manufacturer

Aug 17, 2023 · attack.privilege_escalation attack.t1574 cve.2021.1675 ·

Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

UAC Bypass Abusing Winsat Path Parsing - Registry

Aug 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Using Windows Media Player - Registry

Aug 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass via Sdclt

Aug 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

CobaltStrike Named Pipe

Aug 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe as used by CobaltStrike

CobaltStrike Named Pipe Pattern Regex

Aug 7, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

HackTool - DiagTrackEoP Default Named Pipe

Aug 7, 2023 · attack.privilege_escalation ·

Share on:

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

HackTool - Koh Default Named Pipe

Aug 7, 2023 · attack.privilege_escalation attack.credential_access attack.t1528 attack.t1134.001 ·

Share on:

Detects creation of default named pipes used by the Koh tool

Potential AVKkid.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Potential EACore.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "EACore.dll"

Potential Mfdetours.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Vivaldi_elf.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Potential Shim Database Persistence via Sdbinst.EXE

Aug 1, 2023 · attack.persistence attack.privilege_escalation attack.t1546.011 ·

Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Potential CCleanerDU.DLL Sideloading

Jul 24, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Potential CCleanerReactivator.DLL Sideloading

Jul 20, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Explorer UAC Bypass Via /NOUACCHECK Parameter

Jul 17, 2023 · attack.privilege_escalation attack.T1548.002 ·

Share on:

Detects possible attempt to circumvent the User Account Control (UAC) by executing Windows Explorer to spawn a command line interpreter process without triggering UAC prompts.

Potential appverifUI.DLL Sideloading

Jul 13, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "appverifUI.dll"

UAC Bypass Via Wsreset

Jun 21, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

APT PRIVATELOG Image Load Pattern

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 detection.emerging_threats ·

Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Exploiting CVE-2019-1388

Jun 20, 2023 · attack.privilege_escalation attack.t1068 cve.2019.1388 detection.emerging_threats ·

Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Exploiting SetupComplete.cmd CVE-2019-1378

Jun 20, 2023 · attack.privilege_escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019.1378 detection.emerging_threats ·

Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Moriya Rootkit File Created

Jun 20, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 detection.emerging_threats ·

Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Potential BearLPE Exploitation

Jun 20, 2023 · attack.privilege_escalation attack.t1053.005 car.2013-08-001 detection.emerging_threats ·

Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Potential Dridex Activity

Jun 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging_threats ·

Share on:

Detects potential Dridex acitvity via specific process patterns

Potential SystemNightmare Exploitation Attempt

Jun 20, 2023 · attack.privilege_escalation attack.t1068 detection.emerging_threats ·

Share on:

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

SOURGUM Actor Behaviours

Jun 20, 2023 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege_escalation detection.emerging_threats ·

Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Suspicious RazerInstaller Explorer Subprocess

Jun 20, 2023 · attack.privilege_escalation attack.t1553 detection.emerging_threats ·

Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Potential Waveedit.DLL Sideloading

Jun 15, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module

Jun 14, 2023 · attack.privilege_escalation ·

Share on:

Detects loaded kernel modules that did not meet the WHQL signing requirements.

CodeIntegrity - Blocked Driver Load With Revoked Certificate

Jun 13, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects blocked load attempts of revoked drivers

CodeIntegrity - Blocked Image Load With Revoked Certificate

Jun 13, 2023 · attack.privilege_escalation ·

Share on:

Detects blocked image load events with revoked certificates by code integrity.

CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked

Jun 13, 2023 · attack.privilege_escalation ·

Share on:

Detects block events for files that are disallowed by code integrity for protected processes

CodeIntegrity - Revoked Image Loaded

Jun 13, 2023 · attack.privilege_escalation ·

Share on:

Detects image load events with revoked certificates by code integrity.

CodeIntegrity - Revoked Kernel Driver Loaded

Jun 13, 2023 · attack.privilege_escalation ·

Share on:

Detects the load of a revoked kernel driver

CodeIntegrity - Unsigned Image Loaded

Jun 13, 2023 · attack.privilege_escalation ·

Share on:

Detects loaded unsigned image on the system

CodeIntegrity - Unsigned Kernel Module Loaded

Jun 13, 2023 · attack.privilege_escalation ·

Share on:

Detects the presence of a loaded unsigned kernel module on the system.

Potential Edputil.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "edputil.dll"

Potential 7za.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "7za.dll"

Potential RjvPlatform.DLL Sideloading From Default Location

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Potential RjvPlatform.DLL Sideloading From Non-Default Location

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Jun 9, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Potential Persistence Via GlobalFlags

Jun 5, 2023 · attack.privilege_escalation attack.persistence attack.defense_evasion attack.t1546.012 car.2013-01-002 ·

Share on:

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Potential SmadHook.DLL Sideloading

Jun 2, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Potential Goopdate.DLL Sideloading

May 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

LiveKD Driver Creation

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the creation of the LiveKD driver, which is used for live kernel debugging

LiveKD Driver Creation By Uncommon Process

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

LiveKD Kernel Memory Dump File Created

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

Windows Kernel Debugger Execution

May 17, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects execution of the Windows Kernel Debugger "kd.exe".

Potential RoboForm.DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Potential Chrome Frame Helper DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Potential Wazuh Security Platform DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

PSEXEC Remote Execution File Artefact

May 15, 2023 · attack.lateral_movement attack.privilege_escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·

Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

PUA - Process Hacker Driver Load

May 15, 2023 · attack.privilege_escalation cve.2021.21551 attack.t1543 ·

Share on:

Detects driver load of the Process Hacker tool

PUA - System Informer Driver Load

May 15, 2023 · attack.privilege_escalation attack.t1543 ·

Share on:

Detects driver load of the System Informer tool

Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.

Potential Gamarue DLL Filename (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055.001 ·

Share on:

Detects Gamarue DLL filename in command line strings. Part of the RedCanary 2023 Threat Detection Report.

Powershell Injecting Into Anything (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.

Process Executing Sans Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects processes running without command lines, which can indicate process injection. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Network Connections (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects notepad making network connections, a potential process injection signal. Part of the RedCanary 2023 Threat Detection Report.

Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 9, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Potential Persistence Via PowerShell User Profile Using Add-Content

May 9, 2023 · attack.persistence attack.privilege_escalation attack.t1546.013 ·

Share on:

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Suspicious Child Process Of SQL Server

May 9, 2023 · attack.t1505.003 attack.t1190 attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Suspicious Child Process Of Veeam Dabatase

May 9, 2023 · attack.initial_access attack.persistence attack.privilege_escalation ·

Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Potential SolidPDFCreator.DLL Sideloading

May 8, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Process Explorer Driver Creation By Non-Sysinternals Binary

May 5, 2023 · attack.persistence attack.privilege_escalation attack.t1068 ·

Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Process Monitor Driver Creation By Non-Sysinternals Binary

May 5, 2023 · attack.persistence attack.privilege_escalation attack.t1068 ·

Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Potential DLL Sideloading Of DBGCORE.DLL

May 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbgcore.dll"

Potential DLL Sideloading Of DBGHELP.DLL

May 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbghelp.dll"

Standard User In High Privileged Group

May 5, 2023 · attack.credential_access attack.privilege_escalation ·

Share on:

Detect standard users login that are part of high privileged groups such as the Administrator group

Remote WMI ActiveScriptEventConsumers

May 2, 2023 · attack.lateral_movement attack.privilege_escalation attack.persistence attack.t1546.003 ·

Share on:

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network

CVE-2021-3156 Exploitation Attempt

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing required to trigger the heap-based buffer overflow.

CVE-2021-3156 Exploitation Attempt Bruteforcing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing. required to trigger the heap-based buffer overflow.

Detection of Possible Rotten Potato

Apr 21, 2023 · attack.privilege_escalation attack.t1134 attack.t1134.002 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Disabled Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple disabled domain accounts from a single source system using the Kerberos protocol.

Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Invalid Users Failing To Authenticate From Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.

Invalid Users Failing To Authenticate From Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple invalid domain accounts from a single source system using the Kerberos protocol.

Malicious Service Installations

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1003 attack.t1035 attack.t1050 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Meterpreter or Cobalt Strike Getsystem Service Installation

Apr 21, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

MSI Spawned Cmd and Powershell Spawned Processes

Apr 21, 2023 · attack.privilege_escalation attack.t1548.002 ·

Share on:

This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes

Multiple Users Failing to Authenticate from Single Process

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple accounts from a single process on the system.

Multiple Users Remotely Failing To Authenticate From Single Source

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects a source system failing to authenticate against a remote host with multiple users.

OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Password Spraying via Explicit Credentials

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects a single user failing to authenticate to multiple users using explicit credentials.

Valid Users Failing to Authenticate From Single Source Using Kerberos

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.

Valid Users Failing to Authenticate from Single Source Using NTLM

Apr 21, 2023 · attack.t1110.003 attack.initial_access attack.privilege_escalation ·

Share on:

Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.

Windows Kernel and 3rd-Party Drivers Exploits Token Stealing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level

Potential Libvlc.DLL Sideloading

Apr 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

CobaltStrike Service Installations - System

Apr 14, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

ProcessHacker Privilege Elevation

Apr 14, 2023 · attack.execution attack.privilege_escalation attack.t1543.003 attack.t1569.002 ·

Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Service Installation with Suspicious Folder Pattern

Apr 14, 2023 · attack.persistence attack.privilege_escalation car.2013-09-005 attack.t1543.003 ·

Share on:

Detects service installation with suspicious folder patterns

Vulnerable Netlogon Secure Channel Connection Allowed

Apr 14, 2023 · attack.privilege_escalation attack.t1548 ·

Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Potential Iviewers.DLL Sideloading

Apr 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Potential Rcdll.DLL Sideloading

Apr 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of rcdll.dll

CMSTP UAC Bypass via COM Object Access

Apr 11, 2023 · attack.execution attack.defense_evasion attack.privilege_escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Always Install Elevated Windows Installer

Apr 3, 2023 · attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Aruba Network Service Potential DLL Sideloading

Mar 15, 2023 · attack.privilege_escalation attack.persistence attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Microsoft Office DLL Sideload

Mar 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Important Scheduled Task Deleted/Disabled

Mar 14, 2023 · attack.execution attack.privilege_escalation attack.persistence attack.t1053.005 ·

Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Potential Antivirus Software DLL Sideloading

Mar 13, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Interactive AT Job

Mar 10, 2023 · attack.privilege_escalation attack.t1053.002 ·

Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Sticky Key Like Backdoor Execution

Mar 7, 2023 · attack.privilege_escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·

Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

HackTool - Default PowerSploit/Empire Scheduled Task Creation

Mar 7, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Persistence Via Sticky Key Backdoor

Mar 7, 2023 · attack.t1546.008 attack.privilege_escalation ·

Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Potential Meterpreter/CobaltStrike Activity

Mar 5, 2023 · attack.privilege_escalation attack.t1134.001 attack.t1134.002 ·

Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Potential Privilege Escalation via Service Permissions Weakness

Mar 5, 2023 · attack.privilege_escalation attack.t1574.011 ·

Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Suspicious Child Process Created as System

Mar 5, 2023 · attack.privilege_escalation attack.t1134.002 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Suspicious Debugger Registration Cmdline

Mar 5, 2023 · attack.persistence attack.privilege_escalation attack.t1546.008 ·

Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Suspicious NTLM Authentication on the Printer Spooler Service

Mar 2, 2023 · attack.privilege_escalation attack.credential_access attack.t1212 ·

Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Security Privileges Enumeration Via Whoami.EXE

Feb 28, 2023 · attack.privilege_escalation attack.discovery attack.t1033 ·

Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Service Security Descriptor Tampering Via Sc.EXE

Feb 28, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Suspicious Whoami.EXE Execution From Privileged Process

Feb 28, 2023 · attack.privilege_escalation attack.discovery attack.t1033 ·

Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

User Added to Local Administrators

Feb 27, 2023 · attack.privilege_escalation attack.t1078 attack.persistence attack.t1098 ·

Share on:

This rule triggers on user accounts that are added to the local Administrators group, which could be legitimate activity or a sign of privilege escalation activity

HackTool - Empire PowerShell UAC Bypass

Feb 21, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects some Empire PowerShell UAC bypass methods

New Service Creation Using PowerShell

Feb 21, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects the creation of a new service using powershell.

New Service Creation Using Sc.EXE

Feb 21, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects the creation of a new service using the "sc.exe" utility.

Regedit as Trusted Installer

Feb 21, 2023 · attack.privilege_escalation attack.t1548 ·

Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Suspicious Service Path Modification

Feb 21, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·

Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Potential PrintNightmare Exploitation Attempt

Feb 20, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574 cve.2021.1675 ·

Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Powerup Write Hijack DLL

Feb 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

HackTool - LocalPotato Execution

Feb 14, 2023 · attack.defense_evasion attack.privilege_escalation cve.2023.21746 ·

Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Possible Privilege Escalation via Weak Service Permissions

Feb 14, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.t1574.011 ·

Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Potential UAC Bypass Via Sdclt.EXE

Feb 14, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·

Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

PUA - Wsudo Suspicious Execution

Feb 13, 2023 · attack.execution attack.privilege_escalation attack.t1059 ·

Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

UAC Bypass Tools Using ComputerDefaults

Feb 13, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

UAC Bypass Using Event Viewer RecentViews

Feb 13, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects the pattern of UAC Bypass using Event Viewer RecentViews

Rundll32 Registered COM Objects

Feb 9, 2023 · attack.privilege_escalation attack.persistence attack.t1546.015 ·

Share on:

load malicious registered COM objects

HackTool - Impersonate Execution

Feb 8, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1134.001 attack.t1134.003 ·

Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

SCM Database Privileged Operation

Feb 7, 2023 · attack.privilege_escalation attack.t1548 ·

Share on:

Detects non-system users performing privileged operation os the SCM database

Sdclt Child Processes

Feb 7, 2023 · attack.privilege_escalation attack.t1548.002 ·

Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Buffer Overflow Attempts

Feb 1, 2023 · attack.t1068 attack.privilege_escalation ·

Share on:

Detects buffer overflow attempts in Unix system log files

CobaltStrike Service Installations - Security

Feb 1, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Code Injection by ld.so Preload

Feb 1, 2023 · attack.persistence attack.privilege_escalation attack.t1574.006 ·

Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

Malicious Service Installations

Feb 1, 2023 · attack.persistence attack.privilege_escalation attack.t1003 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Possible Coin Miner CPU Priority Param

Feb 1, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detects command line parameter very often used with coin miners

PowerShell ShellCode

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.execution attack.t1059.001 ·

Share on:

Detects Base64 encoded Shellcode

Shell Open Registry Keys Manipulation

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 attack.t1546.001 ·

Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)