attack.t1068

Suspicious Sysmon as Execution Parent

Sep 13, 2023 · attack.privilege_escalation attack.t1068 cve.2022.41120 detection.emerging_threats ·

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Exploiting CVE-2019-1388

Jun 20, 2023 · attack.privilege_escalation attack.t1068 cve.2019.1388 detection.emerging_threats ·

Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Exploiting SetupComplete.cmd CVE-2019-1378

Jun 20, 2023 · attack.privilege_escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019.1378 detection.emerging_threats ·

Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Potential CVE-2021-41379 Exploitation Attempt

Jun 20, 2023 · attack.privilege_escalation attack.t1068 cve.2021.41379 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Potential SystemNightmare Exploitation Attempt

Jun 20, 2023 · attack.privilege_escalation attack.t1068 detection.emerging_threats ·

Share on:

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

Process Explorer Driver Creation By Non-Sysinternals Binary

May 5, 2023 · attack.persistence attack.privilege_escalation attack.t1068 ·

Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Process Monitor Driver Creation By Non-Sysinternals Binary

May 5, 2023 · attack.persistence attack.privilege_escalation attack.t1068 ·

Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

CVE-2021-3156 Exploitation Attempt

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing required to trigger the heap-based buffer overflow.

CVE-2021-3156 Exploitation Attempt Bruteforcing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing. required to trigger the heap-based buffer overflow.

OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Windows Kernel and 3rd-Party Drivers Exploits Token Stealing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level

Audit CVE Event

Apr 14, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·

Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Vulnerable Driver Load

Apr 12, 2023 · attack.privilege_escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known vulnerable drivers by hash value

Vulnerable Driver Load By Name

Apr 12, 2023 · attack.privilege_escalation attack.t1543.003 attack.t1068 ·

Share on:

Detects the load of known vulnerable drivers via their names only.

HackTool - SysmonEOP Execution

Feb 4, 2023 · cve.2022.41120 attack.t1068 attack.privilege_escalation ·

Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Buffer Overflow Attempts

Feb 1, 2023 · attack.t1068 attack.privilege_escalation ·

Share on:

Detects buffer overflow attempts in Unix system log files

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Feb 1, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Possible Coin Miner CPU Priority Param

Feb 1, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detects command line parameter very often used with coin miners

Sudo Privilege Escalation CVE-2019-14287

Feb 1, 2023 · attack.privilege_escalation attack.t1068 attack.t1548.003 cve.2019.14287 ·

Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Sudo Privilege Escalation CVE-2019-14287 - Builtin

Feb 1, 2023 · attack.privilege_escalation attack.t1068 attack.t1548.003 cve.2019.14287 ·

Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Usage Of Malicious POORTRY Signed Driver

Feb 1, 2023 · attack.privilege_escalation attack.t1543 attack.t1068 ·

Share on:

Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.

Vulnerable Dell BIOS Update Driver Load

Feb 1, 2023 · attack.privilege_escalation cve.2021.21551 attack.t1543 attack.t1068 ·

Share on:

Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551

Nimbuspwn Exploitation

Jan 23, 2023 · attack.privilege_escalation attack.t1068 ·

Share on:

Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)

OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd

Nov 27, 2022 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD HTTP No Authentication RCE

Oct 25, 2022 · attack.privilege_escalation attack.initial_access attack.execution attack.lateral_movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·

Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

OMIGOD SCX RunAsProvider ExecuteScript

Oct 25, 2022 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand

Oct 25, 2022 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

KrbRelayUp local privilege escalation.

Apr 27, 2022 · attack.privilege_escalation attack.t1068 ·

Share on:

Detecting possible successful exploitation using tools such as KrbRelayUp AD environment

Exploitation of 7zip vulnerability - CVE-2022-29072

Apr 25, 2022 · attack.Exploitation for Privilege Escalation attack.T1068 ·

Share on:

Detects possible exploitation vulnerability CVE-2022-29072. This vulnerability is due to 7z.dll misconfiguration. When a .7z file is placed in the Help > Contents area of the current Windows version 21.07, anyone with access to the host can elevate privileges. The command creates a child process of 7zFM.exe.