UAC Bypass via Service Creation

[rule]
description = """
Identifies attempts to bypass User Account Control (UAC) by creating a system Service via a network logon from the
loopback address. Attackers may attempt to bypass UAC or Administrator Protection feature to execute with elevated
permissions.
"""
id = "7ade264a-785c-48ec-8e07-a26a04033faa"
license = "Elastic License v2"
name = "UAC Bypass via Service Creation"
os_list = ["windows"]
reference = [
    "https://splintercod3.blogspot.com/p/bypassing-uac-with-sspi-datagram.html",
    "https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html",
]
version = "1.0.3"

query = '''
sequence with maxspan=1m
 [authentication where event.action == "log_on" and user.id == "S-1-0-0" and
  process.Ext.token.elevation == false and process.Ext.session_info.logon_type == "Network" and user.effective.id != "S-1-5-18" and
  /* network logon from loopback address */
  (
   source.ip == null or
   cidrmatch(source.ip,  "127.0.0.0/8", "::1") or
   startswith~(user.effective.domain, winlog.event_data.WorkstationName)
   )
  ] by user.effective.id, Target.process.Ext.authentication_id
 [any where event.category in ("configuration", "iam") and
  event.action in ("service-installed", "service-install") and process.pid == 0 and
  user.id != "S-1-5-18" and winlog.event_data.ServiceAccount == "LocalSystem"] by user.id, process.Ext.authentication_id
'''

min_endpoint_version = "8.18.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.002"
name = "Bypass User Account Control"
reference = "https://attack.mitre.org/techniques/T1548/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.18.0"