signal_desktop_app_privilege_escalation

rule signal_desktop_app_privilege_escalation {
 meta:
    author = "Halil Ibrahim Cosgun"
    description = "Detects Signal Desktop v1.29 app privilege escalation vulnerability. During the startup the application will execute the c:\\node_modules\\.bin\\wmic.exe binary if it exists. By default on Windows, low privileged users have the privilege to create folders under root level drives.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/JxHcCHvtyUEG"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "sysmon"
    mitre = "Execution, Defense_Evasion, Persistence, Privilege_Escalation, T1218, T1036, T1044"

  events:
(($selection1.metadata.product_event_type = "1" and re.regex($selection1.principal.process.file.full_path, `.*\\\\Signal\.exe`) and re.regex($selection1.target.process.command_line, `.*\\\\node_modules\\\\\.bin\\\\wmic\.exe`)) or ($selection1.metadata.product_event_type = "11" and re.regex($selection1.target.file.full_path, `.*\\\\node_modules\\\\\.bin\\\\wmic\.exe`)))

  condition:
    $selection1
}