Detection rules › Splunk
Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Windows Event Log)
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. Background Activity Moderator is a Windows service that controls activity of background applications. The service was first introduced on Windows 10, specifically, after the Fall Creators Update (version 1709). BAM provides the full path of the executable files that was run on the system as well as the last execution date and time of these files. BAM provides evidence of program execution by listing executables under the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings<SID>" registry key. Each user specific executable is stored under the corresponding SID entry. BAM entries are only populated for locally run executables. Launching executables on network shares or removable media will not generate BAM entries. Similarly, console applications aren't stored on the BAM entry. In addition, BAM entries are removed if an executable is removed from its original location; and entries older than 7 days are removed when Windows boots. This use case detects when an executable running as NT AUTHORITY\SYSTEM was registered in BAM registry key. This behavior was observed in CVE-2024-30088, but it is not specific only to this issue, rather used only as a reference.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1068 Exploitation for Privilege Escalation |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4657 | A registry value was modified. |
Rule body yaml
id: '38391.69031'
title: Executable Running as NT AUTHORITY_SYSTEM Registered in BAM
description: Adversaries may exploit software vulnerabilities in an attempt to elevate
privileges. Exploitation of a software vulnerability occurs when an adversary takes
advantage of a programming error in a program, service, or within the operating
system software or kernel itself to execute adversary-controlled code. Security
constructs such as permission levels will often hinder access to information and
use of certain techniques, so adversaries will likely need to perform privilege
escalation to include use of software exploitation to circumvent those restrictions.
Background Activity Moderator is a Windows service that controls activity of background
applications. The service was first introduced on Windows 10, specifically, after
the Fall Creators Update (version 1709). BAM provides the full path of the executable
files that was run on the system as well as the last execution date and time of
these files. BAM provides evidence of program execution by listing executables under
the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>"
registry key. Each user specific executable is stored under the corresponding SID
entry. BAM entries are only populated for locally run executables. Launching executables
on network shares or removable media will not generate BAM entries. Similarly, console
applications aren't stored on the BAM entry. In addition, BAM entries are removed
if an executable is removed from its original location; and entries older than 7
days are removed when Windows boots. This use case detects when an executable running
as NT AUTHORITY\SYSTEM was registered in BAM registry key. This behavior was observed
in CVE-2024-30088, but it is not specific only to this issue, rather used only as
a reference.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR
"<EventID>4657<") "SYSTEM\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-18"
| rex field=_raw "<Data Name=\"NewValueType\">(?<new_value_type>[^<]+)</Data>"|
rex field=_raw "<Data Name=\"NewValue\">(?<new_value>[^<]+)</Data>" | where match(new_value_type,
"(?i)REG_BINARY") and match(new_value, "(?i)\.exe$") | table _time, host, user,
process, process_*, registry_*, parent_*, new_value_type, new_value | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1068
data_category:
- Windows event logs
- Windows Registry
references:
- https://github.com/tykawaii98/CVE-2024-30088/tree/main
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088
- https://attack.mitre.org/techniques/T1068/
- https://dfir.ru/2020/04/08/bam-internals/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR "<EventID>4657<") "SYSTEM\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-18"
Stage 2: rex
| rex field=_raw "<Data Name=\"NewValueType\">(?<new_value_type>[^<]+)</Data>"
Stage 3: rex
| rex field=_raw "<Data Name=\"NewValue\">(?<new_value>[^<]+)</Data>"
Stage 4: where
| where match(new_value_type, "(?i)REG_BINARY") and match(new_value, "(?i)\.exe$")
Stage 5: table
| table _time, host, user, process, process_*, registry_*, parent_*, new_value_type, new_value
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
new_value | match |
|
new_value_type | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4657<" |
| 1 | "SYSTEM\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-18" |