Elastic Defend high stable eql

Privilege Escalation via Named Pipe Impersonation

Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework like Metasploit's getsystem command.

View Source

Detection Logic

process where event.action == "start" and
   (process.name in~ ("cmd.exe", "powershell.exe", "sc.exe", "schtasks.exe") or 
    process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",  "sc.exe", "schtasks.exe")) and 
   process.command_line : "*echo*>*\\\\.\\pipe\\*" and
   not process.parent.executable like 
           ("?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
            "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
            "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe")

Field Validations

Loading…

Comments (0)

Loading comments...