attack.t1548 | Detection.FYI

Potential Privilege Escalation via Local Kerberos Relay over LDAP

Aug 29, 2024 · attack.privilege-escalation attack.credential-access attack.t1548 ·
Share on:

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
AWS STS AssumeRole Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Read More
AWS STS GetSessionToken Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Read More
AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
CA Policy Removed by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
COM Hijack via Sdclt

Aug 12, 2024 · attack.privilege-escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
Credential Dumping Attempt Via Svchost

Aug 12, 2024 · attack.t1548 ·
Share on:

Detects when a process tries to access the memory of svchost to potentially dump credentials.

Read More
GCP Break-glass Container Workload Deployed

Aug 12, 2024 · attack.defense-evasion attack.t1548 ·
Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Read More
Linux Capabilities Discovery

Aug 12, 2024 · attack.collection attack.privilege-escalation attack.t1123 attack.t1548 ·
Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Read More
Linux Doas Conf File Creation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the creation of doas.conf file in linux host platform.

Read More
Linux Doas Tool Execution

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Read More
New CA Policy by Non-approved Actor

Aug 12, 2024 · attack.defense-evasion attack.t1548 ·
Share on:

Monitor and alert on conditional access changes.

Read More
Regedit as Trusted Installer

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Read More
SCM Database Privileged Operation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects non-system users performing privileged operation os the SCM database

Read More
UAC Bypass via Windows Firewall Snap-In Hijack

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read More
User Added To Group With CA Policy Modification Access

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

Read More
User Removed From Group With CA Policy Modification Access

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

Read More
Vulnerable Netlogon Secure Channel Connection Allowed

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Read More