Suspicious Execution as System via Windows Command Shell

[rule]
description = """
Identifies the execution of the Windows Command Shell with an integrity level of SYSTEM from a parent process with a
Medium integrity level.This behavior is consistent with a successful exploit to escalate privileges and create a process
with SYSTEM privileges.
"""
id = "4d1a0064-f5d3-46df-8e23-5a9d78635764"
license = "Elastic License v2"
name = "Suspicious Execution as System via Windows Command Shell"
os_list = ["windows"]
reference = [
    "https://bsodtutorials.wordpress.com/2014/07/31/windows-integrity-levels-process-explorer-and-windbg/",
]
version = "1.0.2"

query = '''
sequence with maxspan=2m
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name == "medium" and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500)] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name == "system" and
  (process.name : "cmd.exe" or process.pe.original_file_name == "Cmd.Exe")] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.4.0"