This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Process Activity via Compiled HTML File Process Creation via Secondary Logon »
Elastic Docs ›Elastic Security Solution [master] ›Detections and alerts ›Prebuilt rule reference

Process Created with an Elevated Token

edit

Process Created with an Elevated Token

edit

Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Privilege Escalation

Version: 1

Added (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule query

edit
/* This rule is only compatible with Elastic Endpoint 8.4+ */ process
where event.action == "start" and /* CreateProcessWithToken and
effective parent is a privileged MS native binary used as a target for
token theft */ user.id : "S-1-5-18" and /* Token Theft target
process usually running as service are located in one of the following
paths */ process.Ext.effective_parent.executable :
("?:\\Windows\\*.exe", "?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\ProgramData\\*") and not
(process.Ext.effective_parent.executable :
"?:\\Windows\\System32\\Utilman.exe" and
process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
process.parent.args : "/debug") and not process.executable :
("?:\\Windows\\System32\\WerFault.exe",
"?:\\Windows\\SysWOW64\\WerFault.exe",
"?:\\Windows\\System32\\WerFaultSecure.exe",
"?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
"?:\\windows\\system32\\WerMgr.exe", "?:\\W
indows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.e
xe") and not process.parent.executable :
("?:\\Windows\\System32\\AtBroker.exe",
"?:\\Windows\\system32\\svchost.exe", "?:\\Program Files
(x86)\\*.exe", "?:\\Program Files\\*.exe",
"?:\\Windows\\System32\\msiexec.exe",
"C:\\Windows\\System32\\DriverStore\\*") and not
(process.code_signature.trusted == true and
process.code_signature.subject_name in ("philandro Software GmbH",
"Freedom Scientific Inc.", "TeamViewer Germany GmbH", "Projector.is,
Inc.", "TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc"))

Threat mapping

edit

Framework: MITRE ATT&CKTM

« Process Activity via Compiled HTML File Process Creation via Secondary Logon »