Local Privilege Escalation Indicator TabTip

Title: Local Privilege Escalation Indicator TabTip
Status: test
Description:Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode
References:
  -https://github.com/antonioCoco/JuicyPotatoNG
Author: Florian Roth (Nextron Systems)
Date: 2022-10-07
modified:2023-04-14
Tags:

• -'attack.collection'
• -'attack.execution'
• -'attack.credential-access'
• -'attack.t1557.001'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Microsoft-Windows-DistributedCOM'
    EventID: '10001'
    param1: 'C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe'
    param2: '2147943140'
    param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}'
  condition:selection
Falsepositives:
  -Unknown
Level: high