Use Case: Vulnerability

Abnormally Large DNS Response

Oct 3, 2023 · Use Case: Threat Detection Tactic: Lateral Movement Resources: Investigation Guide Use Case: Vulnerability ·

Share on:

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

Microsoft Exchange Server UM Spawning Suspicious Processes

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857.

Microsoft Exchange Server UM Writing Suspicious Files

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.

Persistence via Update Orchestrator Service Hijack

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Use Case: Vulnerability Resources: Investigation Guide Data Source: Elastic Endgame Data Source: Elastic Defend ·

Share on:

Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM.

Potential JAVA/JNDI Exploitation Attempt

Sep 5, 2023 · Domain: Endpoint OS: Linux OS: macOS Use Case: Threat Detection Tactic: Execution Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard ports followed by a suspicious JAVA child processes. This may indicate an attempt to exploit a JAVA/NDI (Java Naming and Directory Interface) injection vulnerability.

Potential Linux Credential Dumping via Proc Filesystem

Sep 5, 2023 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Credential Access Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords.

Potential Privilege Escalation via InstallerFileTakeOver

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.

Potential Privilege Escalation via OverlayFS

Sep 5, 2023 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies an attempt to exploit a local privilege escalation (CVE-2023-2640 and CVE-2023-32629) via a flaw in Ubuntu's modifications to OverlayFS. These flaws allow the creation of specialized executables, which, upon execution, grant the ability to escalate privileges to root on the affected machine.

Potential Privilege Escalation via PKEXEC

Sep 5, 2023 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.

Potential Remote Code Execution via Web Server

Sep 5, 2023 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Initial Access Data Source: Elastic Endgame Use Case: Vulnerability Resources: Investigation Guide Data Source: Elastic Defend ·

Share on:

Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.

Sudo Heap-Based Buffer Overflow Attempt

Sep 5, 2023 · Domain: Endpoint OS: Linux OS: macOS Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.

Suspicious Child Process of Adobe Acrobat Reader Update Service

Sep 5, 2023 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched.

Suspicious JAVA Child Process

Sep 5, 2023 · Domain: Endpoint OS: Linux OS: macOS Use Case: Threat Detection Tactic: Execution Resources: Investigation Guide Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a JAVA specific vulnerability.

Suspicious Print Spooler File Deletion

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities.

Suspicious Print Spooler Point and Print DLL

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM.

Suspicious Print Spooler SPL File Created

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337.

Suspicious PrintSpooler Service Executable File Creation

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched.

TCC Bypass via Mounted APFS Snapshot Access

Sep 5, 2023 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Defense Evasion Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC).

Unusual Child Process of dns.exe

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.

Unusual File Modification by dns.exe

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.

Unusual Print Spooler Child Process

Sep 5, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows.

Potential Sudo Privilege Escalation via CVE-2019-14287

Aug 31, 2023 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Defend Use Case: Vulnerability ·

Share on:

This rule monitors for the execution of a suspicious sudo command that is leveraged in CVE-2019-14287 to escalate privileges to root. Sudo does not verify the presence of the designated user ID and proceeds to execute using a user ID that can be chosen arbitrarily. By using the sudo privileges, the command "sudo -u#-1" translates to an ID of 0, representing the root user. This exploit may work for sudo versions prior to v1.28.

Potential Privilege Escalation via Recently Compiled Executable

Aug 31, 2023 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Vulnerability Data Source: Elastic Defend ·

Share on:

This rule monitors a sequence involving a program compilation event followed by its execution and a subsequent alteration of UID permissions to root privileges. This behavior can potentially indicate the execution of a kernel or software privilege escalation exploit.

Remote Computer Account DnsHostName Update

Aug 21, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Use Case: Vulnerability ·

Share on:

Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.

Potential Privileged Escalation via SamAccountName Spoofing

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Use Case: Vulnerability ·

Share on:

Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing.

Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Use Case: Vulnerability ·

Share on:

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.