Sticky key sethc file failed replacement

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1546.008` Event Triggered Execution: Accessibility Features

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4656: A handle to an object was requested.

Rule body

title: Sticky key sethc file failed replacement
description: Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1546-Image%20File%20Execution%20Options%20Injection
- https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
- https://www.mandiant.com/resources/apt29-domain-frontin
- https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
tags:
- attack.privilege_escalation
- attack.t1546.008
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection: # No ID 4688 will be triggered if access is denied
    EventID: 4656
    ObjectServer: Security
    ObjectType: File
    ObjectName|endswith: 'sethc.exe'
    ProcessName|endswith: 'cmd.exe'
    EventType: AUDIT_FAILURE
    AccessReason|contains: '%4417: %%1805' # WriteData (or AddFile):  Not granted
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4656
  ObjectServer: Security
  ObjectType: File
  ObjectName|endswith: 'sethc.exe'
  ProcessName|endswith: 'cmd.exe'
  EventType: AUDIT_FAILURE
  AccessReason|contains: '%4417: %%1805'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessReason`	match	`%4417: %%1805`	`field:"AccessReason" kind:match value:"%4417: %%1805"`
`EventType`	eq	`AUDIT_FAILURE`	`field:"EventType" kind:eq value:"AUDIT_FAILURE"`
`ObjectName`	ends_with	`sethc.exe`	`field:"ObjectName" kind:ends_with value:"sethc.exe"`
`ObjectServer`	eq	`Security` corpus 5 (sigma 5)	`field:"ObjectServer" kind:eq value:"Security"`
`ObjectType`	eq	`File` corpus 10 (sigma 8, splunk 2)	`field:"ObjectType" kind:eq value:"File"`
`ProcessName`	ends_with	`cmd.exe` corpus 2 (sigma 1, splunk 1)	`field:"process_name" kind:ends_with value:"cmd.exe"`

Sticky key sethc file failed replacement

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`