Elastic Defend high stable eql

Potential Privilege Escalation via LocalPotato Exploit

Identifies a privilege escalation attempt via local NTLM relay attack targeting the local SMB server via exploiting a context swapping vulnerability during the authentication process. The LocalPotato attack is a type of NTLM reflection attack that targets local authentication. This attack allows for arbitrary file read/write and elevation of privilege.

View Source

Detection Logic

sequence with maxspan=1m
 [network where destination.port == 445 and process.pid != 4 and
  destination.address : ("127.*", "::1") and not user.id : "S-1-5-18"]
 [file where process.pid == 4 and file.path : ("?:\\Windows\\*", "?:\\Program Files*", "?:\\ProgramData\\Microsoft\\*") and
  Effective_process.name == "svchost.exe" and user.id : "S-1-5-18" and (file.Ext.header_bytes : "4d5a*" or file.extension : "dll")]

Field Validations

Loading…

Comments (0)

Loading comments...