Privilege Escalation via Named Pipe Impersonation

[rule]
description = """
Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by
utilizing a framework like Metasploit's getsystem command.
"""
id = "a0265178-779d-4bc5-b3f1-abb3bcddedab"
license = "Elastic License v2"
name = "Privilege Escalation via Named Pipe Impersonation"
os_list = ["windows"]
reference = [
    "https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation",
]
version = "1.0.35"

query = '''
process where event.action == "start" and
   (process.name in~ ("cmd.exe", "powershell.exe", "sc.exe", "schtasks.exe") or 
    process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",  "sc.exe", "schtasks.exe")) and 
   process.command_line : "*echo*>*\\\\.\\pipe\\*" and
   not process.parent.executable like 
           ("?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
            "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
            "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"