Meterpreter or Cobalt Strike Getsystem Service Installation - System

Title: Meterpreter or Cobalt Strike Getsystem Service Installation - System
Status: test
Description:Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  -https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
Date: 2019-10-26
modified:2023-11-15
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1134.001'
• -'attack.t1134.002'

Logsource:

• product: windows
• service: system

Detection:
  selection_id:
    Provider_Name: 'Service Control Manager'
    EventID: '7045'
  selection_cli_cmd:
    ImagePath|contains|all:
      -'/c'
      -'echo'
      -'\pipe\'

    ImagePath|contains:
      -'cmd'
      -'%COMSPEC%'

  selection_cli_rundll:
    ImagePath|contains|all:
      -'rundll32'
      -'.dll,a'
      -'/p:'

  selection_cli_share:
    ImagePath|startswith: '\\\\127.0.0.1\\ADMIN$\'
  condition:selection_id and 1 of selection_cli_*
Falsepositives:
  -Unlikely
Level: high