Elastic Defend high stable eql

Potential Privilege Escalation via Rogue WinRM

Identifies a privilege escalation attempt via impersonation using RogueWinRM. RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account (with SeImpersonatePrivilege) to Local System account if the WinRM service is not running.

View Source

Detection Logic

sequence with maxspan=1m
 [network where process.pid != 4 and event.action == "disconnect_received" and

  /* localhost connection via WinRM default listening port */
  destination.port == 5985 and source.port >= 49152 and
  destination.address : ("127.*", "::1") and source.address : ("127.*", "::1") and
  not process.executable : "?:\\Windows\\System32\\svchost.exe" and user.id != "S-1-5-18"] by process.entity_id
 [process where event.action == "start" and user.id == "S-1-5-18" and
  /* started via seclogon service */
  process.parent.Ext.real.pid > 0 and
  not process.executable : "?:\\Windows\\System32\\WerFault.exe"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...