mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
51 lines
2.0 KiB
JSON
51 lines
2.0 KiB
JSON
{
|
|
"category": "Adversary Tactics",
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-12-07",
|
|
"description": "Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.",
|
|
"id": "644e22d3-598a-429c-a007-16fdb802cae5",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-12-07",
|
|
"name": "Windows Privilege Escalation",
|
|
"narrative": "Privilege escalation is a \"land-and-expand\" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://attack.mitre.org/wiki/Privilege_Escalation"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Overwriting Accessibility Binaries",
|
|
"Registry Keys Used For Privilege Escalation",
|
|
"Uncommon Processes On Endpoint",
|
|
"Child Processes of Spoolsv.exe"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Get Parent Process Info"
|
|
],
|
|
"support_searches": []
|
|
},
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|