Exploiting SetupComplete.cmd CVE-2019-1378

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
Source: github.com/SigmaHQ/sigma

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.003` Command and Scripting Interpreter: Windows Command Shell `T1574` Hijack Execution Flow
Privilege Escalation	`T1068` Exploitation for Privilege Escalation
Stealth	`T1574` Hijack Execution Flow

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Exploiting SetupComplete.cmd CVE-2019-1378
id: 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
status: test
description: Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
references:
    - https://web.archive.org/web/20200530031708/https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
date: 2019-11-15
modified: 2021-11-27
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1068
    - attack.execution
    - attack.t1059.003
    - attack.t1574
    - cve.2019-1378
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentCommandLine|contains|all:
            - '\cmd.exe'
            - '/c'
            - 'C:\Windows\Setup\Scripts\'
        ParentCommandLine|endswith:
            - 'SetupComplete.cmd'
            - 'PartnerSetupComplete.cmd'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\Setup\'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    ParentCommandLine|contains|all:
        - '\cmd.exe'
        - '/c'
        - 'C:\Windows\Setup\Scripts\'
    ParentCommandLine|endswith:
        - 'SetupComplete.cmd'
        - 'PartnerSetupComplete.cmd'

Stage 2: `not filter`

filter:
    Image|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
        - 'C:\Windows\Setup\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Windows\Setup\`	`excludes:Image` `field:"Image" value:"C:\Windows\Setup\"`
`Image`	starts_with	`C:\Windows\SysWOW64\`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\"`
`Image`	starts_with	`C:\Windows\System32\`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\"`
`Image`	starts_with	`C:\Windows\WinSxS\`	`excludes:Image` `field:"Image" value:"C:\Windows\WinSxS\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ParentCommandLine`	ends_with	`PartnerSetupComplete.cmd` `SetupComplete.cmd`	`field:"ParentCommandLine" kind:ends_with`
`ParentCommandLine`	match	`/c` corpus 3 (sigma 3) `C:\Windows\Setup\Scripts\` `\cmd.exe`	`field:"ParentCommandLine" kind:match`