Detection rules › Sigma
New rights granted to an account for privilege escalation
Detects scenarios where an attacker grants new rights to an account in order to escalate privileges
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1134 Access Token Manipulation |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4704 | A user right was assigned. |
| Security-Auditing | Event ID 4717 | System security access was granted to an account. |
Rule body yaml
title: New rights granted to an account for privilege escalation
description: Detects scenarios where an attacker grants new rights to an account in order to escalate privileges
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1134-Access%20Token%20Manipulation
- https://medium.com/palantir/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4717
- https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment
- https://medium.com/falconforce/falconfriday-detecting-lsass-dumping-with-debug-privileges-0xff1f-328fdb78f5be
tags:
- attack.privilege_escalation
- attack.t1134
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4717 # logon right changed
- 4704 # right assigned
filter:
SubjectUserName|endswith: '$'
condition: selection and not filter
falsepositives:
- Specific account configuration
level: medium
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
EventID:
- 4717
- 4704
Stage 2: not filter
filter:
SubjectUserName|endswith: '$'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
SubjectUserName | ends_with | $ |