detection.wiki

Detection rules › Splunk

Consent.exe Suspicious Child Process (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Consent.exe is a process created by Microsoft Windows that is responsible for managing User Account Control (UAC) consent. This use case detects any suspicious child process of consent.exe in attempt to escalate privileges.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059 Command and Scripting Interpreter
Privilege EscalationT1068 Exploitation for Privilege Escalation

References

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

id: '32338.57521'
title: Consent.exe Suspicious Child Process
description: Consent.exe is a process created by Microsoft Windows that is responsible
  for managing User Account Control (UAC) consent. This use case detects any suspicious
  child process of consent.exe in attempt to escalate privileges.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "consent.exe" | regex parent_process_path="(?i):\x5cWindows\x5csystem32\x5cconsent\.exe"
  | regex process_path!="(?i):\x5cWindows\x5csystem32\x5cWerFault\.exe"| table _time,
  host, user, process, process_*, parent_* | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:command and scripting interpreter
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1059
- T1068
data_category:
- Windows event logs
references:
- https://blog.snapattack.com/hunting-cve-2024-30051-8de021f0cf77
- https://www.youtube.com/watch?v=G5tlqwWZdJA
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1548/002/

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "consent.exe"

Stage 2: regex

| regex parent_process_path="(?i):\x5cWindows\x5csystem32\x5cconsent\.exe"

Stage 3: regex

| regex process_path!="(?i):\x5cWindows\x5csystem32\x5cWerFault\.exe"

Stage 4: table

| table _time, host, user, process, process_*, parent_*

Stage 5: bucket

| bin span=1s

Stage 6: stats

| stats values(*) as * by _time, host

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
process_pathregex_match"(?i):\x5cWindows\x5csystem32\x5cWerFault.exe"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4688 corpus 313 (splunk 283, kusto 30)
parent_process_pathregex_match
  • "(?i):\x5cWindows\x5csystem32\x5cconsent.exe" corpus 2 (splunk 2)

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1"<EventID>4688<"
1"consent.exe"