detection.wiki

Detection rules › Sigma

Abused Debug Privilege by Arbitrary Parent Processes

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Semanur Guneysu @semanurtg, oscd.community
Source
github.com/SigmaHQ/sigma

Detection of unusual child processes by different system processes

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1548 Abuse Elevation Control Mechanism

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Abused Debug Privilege by Arbitrary Parent Processes
id: d522eca2-2973-4391-a3e0-ef0374321dae
status: test
description: Detection of unusual child processes by different system processes
references:
    - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg
author: 'Semanur Guneysu @semanurtg, oscd.community'
date: 2020-10-28
modified: 2022-11-11
tags:
    - attack.privilege-escalation
    - attack.t1548
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\winlogon.exe'
            - '\services.exe'
            - '\lsass.exe'
            - '\csrss.exe'
            - '\smss.exe'
            - '\wininit.exe'
            - '\spoolsv.exe'
            - '\searchindexer.exe'
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\cmd.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'Cmd.Exe'
    filter:
        CommandLine|contains|all:
            - ' route '
            - ' ADD '
    condition: all of selection_* and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_* and not filter

Stage 1: selection_parent

selection_parent:
    ParentImage|endswith:
        - '\winlogon.exe'
        - '\services.exe'
        - '\lsass.exe'
        - '\csrss.exe'
        - '\smss.exe'
        - '\wininit.exe'
        - '\spoolsv.exe'
        - '\searchindexer.exe'
    User|contains:
        - 'AUTHORI'
        - 'AUTORI'

Stage 2: selection_img

selection_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\cmd.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
          - 'Cmd.Exe'

Stage 3: not filter

filter:
    CommandLine|contains|all:
        - ' route '
        - ' ADD '

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematch ADD
CommandLinematch route

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
OriginalFileNameeq
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)
  • PowerShell.EXE corpus 120 (sigma 84, splunk 30, elastic 6)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)
ParentImageends_with
  • \csrss.exe corpus 3 (sigma 3)
  • \lsass.exe corpus 3 (sigma 3)
  • \searchindexer.exe corpus 3 (sigma 3)
  • \services.exe corpus 8 (sigma 8)
  • \smss.exe corpus 2 (sigma 2)
  • \spoolsv.exe corpus 5 (sigma 5)
  • \wininit.exe corpus 2 (sigma 2)
  • \winlogon.exe corpus 5 (sigma 5)
Usermatch
  • AUTHORI corpus 14 (sigma 14)
  • AUTORI corpus 14 (sigma 14)