Elastic Defend high stable eql

Unusual Child Process Integrity Level

Identifies the execution of a process with an integrity level of SYSTEM from a parent process with an integrity level of Low or Medium. This behavior is consistent with a successful exploit to escalate privileges and create a process with SYSTEM privileges.

View Source

Detection Logic

sequence with maxspan=5m
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name in ("medium", "low") and
  not (process.executable : "C:\\Program Files\\NZXT CAM\\NZXT CAM.exe" and
       process.code_signature.subject_name : "NZXT, Inc." and process.code_signature.trusted == true)
  ] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name == "system" and user.id : "S-1-5-18" and
  /* limiting rule scope to processes created via seclogon to avoid some weird FPs */
  process.parent.Ext.real.pid > 0 and
  not process.executable :
            ("?:\\Windows\\System32\\wermgr.exe",
             "?:\\Windows\\System32\\WerFault.exe",
             "?:\\Windows\\SysWOW64\\WerFault.exe",
             "?:\\Windows\\System32\\WerFaultSecure.exe",
             "?:\\Windows\\System32\\MpSigStub.exe",
             "?:\\Program Files\\Microsoft EPM Agent\\EpmConsentUI\\EpmConsentUI.exe")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...