Elastic Defend high stable eql

Privilege Escalation via Windir or SystemRoot Environment Variable

Identifies a privilege escalation attempt via a rogue Windows directory (Windir) or System Root environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.

View Source

Detection Logic

registry where registry.data.strings != null and
 not user.id : "S-1-5-18" and
 registry.path : ("HKEY_USERS\\*\\windir", "HKEY_USERS\\*\\systemroot") and
 not registry.data.strings : ("?:\\windows", "?SystemRoot?") and
 not registry.path : "HKEY_USERS\\*\\SOFTWARE\\*"

Field Validations

Loading…

Comments (0)

Loading comments...