Always Install Elevated MSI Spawned Cmd And Powershell

Title: Always Install Elevated MSI Spawned Cmd And Powershell
Status: test
Description:Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"
References:
  -https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
Date: 2020-10-13
modified:2022-10-20
Tags:

• -'attack.privilege-escalation'
• -'attack.t1548.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
    - Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'Cmd.Exe'
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_parent:
    ParentImage|contains|all:
      -'\Windows\Installer\'
      -'msi'

    ParentImage|endswith: 'tmp'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium