Detection rules › Kusto
ShieldBreak: Defender AV Privilege Escalation
The query below detects processes created with System-level integrity by wermgr.exe. DLLs loaded during the exploitation is not recorded in MDE for some reason (filtering/sampling). That's why process creation chain is more reliable.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | No specific technique |
References
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Microsoft Defender for Endpoint | DeviceProcessEvents action any: Process activity |
Rule body
// Description: detects processes created with System-level integrity by wermgr.exe
// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://academy.bluraven.io)
//
// Query Parameters
DeviceProcessEvents
| where
(InitiatingProcessFileName =~ "wermgr.exe" and ProcessIntegrityLevel =~ "System") or
(InitiatingProcessParentFileName =~ "wermgr.exe" and ProcessIntegrityLevel =~ "System")
Stages and Predicates
Stage 1: source
DeviceProcessEvents
Stage 2: where
| where
(InitiatingProcessFileName =~ "wermgr.exe" and ProcessIntegrityLevel =~ "System") or
(InitiatingProcessParentFileName =~ "wermgr.exe" and ProcessIntegrityLevel =~ "System")
Indicators
These rows show field, operator, and value matches.