splunk-security_content/docs/_stories/windows_privilege_escalation.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Windows Privilege Escalation	2020-02-04	true		Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2020-02-04
• Author: David Dorsey, Splunk
• ID: 644e22d3-598a-429c-a007-16fdb802cae5

Narrative

Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.

Detections

Name	Technique	Type
Active Setup Registry Autostart	Active Setup, Boot or Logon Autostart Execution	TTP
Change Default File Association	Change Default File Association, Event Triggered Execution	TTP
Child Processes of Spoolsv exe	Exploitation for Privilege Escalation	TTP
ETW Registry Disabled	Indicator Blocking, Trusted Developer Utilities Proxy Execution, Impair Defenses	TTP
Kerberoasting spn request with RC4 encryption	Kerberoasting, Steal or Forge Kerberos Tickets	TTP
Logon Script Event Trigger Execution	Boot or Logon Initialization Scripts, Logon Script (Windows)	TTP
Overwriting Accessibility Binaries	Event Triggered Execution, Accessibility Features	TTP
Print Processor Registry Autostart	Print Processors, Boot or Logon Autostart Execution	TTP
Registry Keys Used For Privilege Escalation	Image File Execution Options Injection, Event Triggered Execution	TTP
Runas Execution in CommandLine	Access Token Manipulation, Token Impersonation/Theft	Hunting
Screensaver Event Trigger Execution	Event Triggered Execution, Screensaver	TTP
Time Provider Persistence Registry	Time Providers, Boot or Logon Autostart Execution	TTP

Reference

• https://attack.mitre.org/tactics/TA0004/

source | version: 2