Title:
Potential Privilege Escalation To LOCAL SYSTEM
Status:
test
Description:Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
References:
-https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
-https://www.poweradmin.com/paexec/
-https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-05-22
modified:2024-03-05
Tags:
- -'attack.resource-development'
- -'attack.t1587.001'
Logsource:
- category: process_creation
- product: windows
Detection:
selection:
CommandLine|contains|windash:
-' -s cmd'
-' -s -i cmd'
-' -i -s cmd'
-' -s pwsh'
-' -s -i pwsh'
-' -i -s pwsh'
-' -s powershell'
-' -s -i powershell'
-' -i -s powershell'
filter_main_exclude_coverage:
CommandLine|contains:
-'paexec'
-'PsExec'
-'accepteula'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-Weird admins that rename their tools
-Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing
Level:
high
