Elastic Defend high stable eql

Privilege Escalation via Windows Installer Hijack

Identifies the creation or modification of a Windows Installer rollback script (rbs) by an unusual process followed by the execution of process as SYSTEM. rbs files instruct the MSI service to rollback all the modification in the case of a failed installation. This behavior can be abused by an adversary to replace a legit rbs file with a rogue one via a file system oplock and race condition, then triggering an MSI rollback operation leading potentially to a privilege escalation.

View Source

Detection Logic

sequence with maxspan=5m
 [file where event.action != "deletion" and
  file.extension : "rbs" and file.path : "?:\\Config.msi\\*" and
  not user.id : "S-1-5-18" and
  not process.executable : ("?:\\Windows\\system32\\msiexec.exe", "?:\\Windows\\syswow64\\msiexec.exe")] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name : "system" and
  process.parent.name : "msiexec.exe" and process.parent.args : "/V"] by process.Ext.effective_parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...