Potential Privilege Escalation via LocalPotato Exploit

[rule]
description = """
Identifies a privilege escalation attempt via local NTLM relay attack targeting the local SMB server via exploiting a
context swapping vulnerability during the authentication process. The LocalPotato attack is a type of NTLM reflection
attack that targets local authentication. This attack allows for arbitrary file read/write and elevation of privilege.
"""
id = "27a3e57c-d5ae-42bd-99de-052f29dbfb13"
license = "Elastic License v2"
name = "Potential Privilege Escalation via LocalPotato Exploit"
os_list = ["windows"]
reference = [
    "https://www.localpotato.com/localpotato_html/LocalPotato.html",
    "https://github.com/decoder-it/LocalPotato",
]
version = "1.0.17"

query = '''
sequence with maxspan=1m
 [network where destination.port == 445 and process.pid != 4 and
  destination.address : ("127.*", "::1") and not user.id : "S-1-5-18"]
 [file where process.pid == 4 and file.path : ("?:\\Windows\\*", "?:\\Program Files*", "?:\\ProgramData\\Microsoft\\*") and
  Effective_process.name == "svchost.exe" and user.id : "S-1-5-18" and (file.Ext.header_bytes : "4d5a*" or file.extension : "dll")]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.4.0"