locate-ALPC-local-privilege-elevation-exploit

Description

This query was originally published in the threat analytics report, ALPC local privilege elevation. Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrary code or to gain access to protected directories and areas of the operating system. This vulnerability was patched in the September 2018 Security Update. The following query checks for potential activity related to this vulnerability over the past 7 days. If you wish to check another time period, update the EventTime value. References: https://nvd.nist.gov/vuln/detail/CVE-2018-8440 https://support.microsoft.com/help/4457143/windows-81-update-kb4457143

Query · kql

DeviceFileEvents 
| where Timestamp > ago(7d)
and FileName =~ "printconfig.dll"
and InitiatingProcessIntegrityLevel != "System"
and InitiatingProcessIntegrityLevel != "High"
and FolderPath contains @":\Windows"
Raw source locate-ALPC-local-privilege-elevation-exploit · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8f26a2c6-4c60-469c-ac7a-f4d1ccccab9f
name: locate-ALPC-local-privilege-elevation-exploit
description: |
  This query was originally published in the threat analytics report, ALPC local privilege elevation.
  Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrary code or to gain access to protected directories and areas of the operating system.
  This vulnerability was patched in the September 2018 Security Update.
  The following query checks for potential activity related to this vulnerability over the past 7 days. If you wish to check another time period, update the EventTime value.
  References:
  https://nvd.nist.gov/vuln/detail/CVE-2018-8440
  https://support.microsoft.com/help/4457143/windows-81-update-kb4457143
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Privilege escalation
query: |
  DeviceFileEvents 
  | where Timestamp > ago(7d)
  and FileName =~ "printconfig.dll"
  and InitiatingProcessIntegrityLevel != "System"
  and InitiatingProcessIntegrityLevel != "High"
  and FolderPath contains @":\Windows"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.