Unusual Privilege Escalation to System

[rule]
description = """
Identifies the execution of a process as the SYSTEM account from a parent process not running as SYSTEM. This behavior
is consistent with a successful exploit to escalate privileges and create a process with SYSTEM privileges.
"""
id = "fc371c1e-8f08-44e7-aec7-8f462afe5262"
license = "Elastic License v2"
name = "Unusual Privilege Escalation to System"
os_list = ["windows"]
reference = [
    "https://bsodtutorials.wordpress.com/2014/07/31/windows-integrity-levels-process-explorer-and-windbg/",
]
version = "1.0.24"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*")] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name == "system" and user.id == "S-1-5-18" and
  process.Ext.effective_parent.name != null and
  process.parent.Ext.real.pid == null and
  not process.executable :
            ("?:\\Windows\\System32\\wermgr.exe",
             "?:\\Windows\\System32\\WerFault.exe",
             "?:\\Windows\\SysWOW64\\WerFault.exe",
             "?:\\Windows\\System32\\WerFaultSecure.exe",
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
  not (process.name : "rundll32.exe" and
       process.args : ("?:\\windows\\system32\\davclnt.dll,DavSetCookie", "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and
       process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\SysWOW64\\svchost.exe")) and

  not (process.code_signature.subject_name : "Secure By Design Inc." and process.code_signature.trusted == true)

  ] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.4.0"