Unusual Child Process Integrity Level

[rule]
description = """
Identifies the execution of a process with an integrity level of SYSTEM from a parent process with an integrity level of
Low or Medium. This behavior is consistent with a successful exploit to escalate privileges and create a process with
SYSTEM privileges.
"""
id = "9ac68ab0-d251-4c84-a8df-85779ccc728f"
license = "Elastic License v2"
name = "Unusual Child Process Integrity Level"
os_list = ["windows"]
reference = [
    "https://bsodtutorials.wordpress.com/2014/07/31/windows-integrity-levels-process-explorer-and-windbg/",
]
version = "1.0.36"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name in ("medium", "low") and
  not (process.executable : "C:\\Program Files\\NZXT CAM\\NZXT CAM.exe" and
       process.code_signature.subject_name : "NZXT, Inc." and process.code_signature.trusted == true)
  ] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name == "system" and user.id : "S-1-5-18" and
  /* limiting rule scope to processes created via seclogon to avoid some weird FPs */
  process.parent.Ext.real.pid > 0 and
  not process.executable :
            ("?:\\Windows\\System32\\wermgr.exe",
             "?:\\Windows\\System32\\WerFault.exe",
             "?:\\Windows\\SysWOW64\\WerFault.exe",
             "?:\\Windows\\System32\\WerFaultSecure.exe",
             "?:\\Windows\\System32\\MpSigStub.exe",
             "?:\\Program Files\\Microsoft EPM Agent\\EpmConsentUI\\EpmConsentUI.exe")] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"