Elastic Defend high stable eql

Privilege Escalation via NTLMRelay2Self

Identifies attempt to coerce a local NTLM authentication via HTTP using Printer Spooler service as a target. An adversary may use this primitive in combination with others to elevate privileges on a compromised system.

View Source

Detection Logic

process where event.action == "start" and
  process.name : "rundll32.exe" and 
  
  /* Rundll32 WbeDav Client  */
  process.args : ("?:\\Windows\\System32\\davclnt.dll,DavSetCookie", "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and 
  
  /* Access to named pipe via http */
  process.args : ("http*/print/pipe/*", "http*/pipe/spoolss", "http*/pipe/srvsvc")

Field Validations

Loading…

Comments (0)

Loading comments...