Potential Privilege Escalation via File Redirection

[rule]
description = """
Identifies suspicious modification of an executable file in a protected Windows directory and by a medium or low
integrity process. This may indicate an attempt to elevate privileges via privileged file redirection vulnerabilities or
weak permissions.
"""
id = "3de7dc4a-9c3d-459d-b760-670ec240078e"
license = "Elastic License v2"
name = "Potential Privilege Escalation via File Redirection"
os_list = ["windows"]
reference = [
    "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html",
    "https://i.blackhat.com/EU-21/Thursday/EU-21-Yan-From-Logic-to-Memory-Winning-the-Solitaire-in-Reparse-Points.pdf",
]
version = "1.0.43"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and process.Ext.token.integrity_level_name : "medium" and
  not process.executable :
              ("?:\\Program Files\\Npcap\\NPFInstall.exe",
               "?:\\Program Files\\Wireshark\\npcap-*.exe",
               "?:\\Program Files\\Npcap\\Uninstall.exe",
               "?:\\Program Files (x86)\\SigmaPlot\\SPW12\\Spw.exe",
               "?:\\Program Files (x86)\\LABEL MATRIX *\\lmw.exe",
               "?:\\Program Files (x86)\\LABEL MATRIX *\\lmwprint.exe",
               "?:\\Program Files (x86)\\LABEL MATRIX *\\UpgradeWizard.exe",
               "?:\\Program Files\\IHS Markit\\KingdomSuite\\TKS *\\TKS.exe",
               "?:\\Program Files (x86)\\Teklynx\\*\\Lppa.exe",
               "?:\\Program Files (x86)\\LABEL MATRIX *\\lmw.exe",
               "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\*\\MicrosoftEdge*.exe",
               "?:\\Program Files (x86)\\PRTG Network Monitor\\npcapoem.exe",
               "?:\\Program Files\\MicroSurvey\\*\\MSEmbed.exe",
               "?:\\Program Files\\SYSTAT 12\\App\\SYSTAT.exe",
               "?:\\Program Files (x86)\\TerminalWorks\\TSScan\\TSScanUser.exe",
               "?:\\Program Files (x86)\\TerminalWorks\\TSWebCam Pro Server\\TSWebCamDecoder.exe",
               "?:\\Program Files (x86)\\Teklynx\\*\\UpgradeWizard.exe",
               "?:\\Program Files (x86)\\SigmaPlot\\SPW10\\Spw.exe",
               "?:\\Program Files\\MiniTool Partition Wizard ??\\partitionwizard.exe") and
  not (process.code_signature.subject_name :
         ("Freedom Scientific Inc", "Cisco WebEx LLC", "KYOCERA Document Solutions Inc.",
          "Zucchetti S.p.A.", "TEKLYNX CORPORATION SAS", "SimTech Systems, Inc.") and
       process.code_signature.trusted == true) and
  not user.id : "S-1-5-21-*-500" and
  not process.hash.sha256 :
                   ("d22e5e9df76762eb30fa15849120e3678a95dec7d3eecf4feeaef176e9c459c6",
                    "7dcf80152c95404403e8657f9c38ae3fd123ca18891485ca34e39efc0ca6e4b2",
                    "8ec2f2ac521012cd21dea87f2362a2b16d6252ff70c2e6d052e9246db89d7a5b",
                    "ea5275eff082741035ff8f5234df9590e7fa2826d8c0f76555ead60071538028",
                    "a6363cc36aa99da0c8277f5e66c9dd22de78d387e8cb40e5670085f4cf7b0dec",
                    "c1eb4b120746fcf3fe43b362a9e437c5266cf3f82a4935d469fcc6f10c017bd5",
                    "a95577ebbc67fc45b319e2ef3a55f4e9b211fe82ed4cb9d8be6b1a9e2425ce53",
                    "65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289",
                    "5b01d964ced28c1ff850b4de05a71f386addd815a30c4a9ee210ef90619df58e",
                    "d2e98889031fa8e896b3f78e95f5f4e41757b87cf6117e4adf4f2147c81adaa9",
                    "b5eec693af1efcafd10914b01c2995299671a19c1547407d238d5a3502d77d70")
 ]
 [file where event.action != "deletion" and event.action != "open" and
  (file.extension : ("exe", "com", "dll") or file.Ext.header_bytes : "4d5a*") and
  file.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Program Files (x86)\\Microsoft\\*", "?:\\Program Files\\Microsoft\\*") and
  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable != null and
  not file.path : ("?:\\Windows\\System32\\Tasks\\*",
                   "?:\\Windows\\SysWOW64\\wpcap.dll",
                   "?:\\Windows\\SysWOW64\\Npcap\\wpcap.dll",
                   "?:\\WINDOWS\\system32\\KOBDrvAPIIF.DLL",
                   "?:\\WINDOWS\\SysWOW64\\uvxv1us.dll",
                   "?:\\Windows\\SysWOW64\\rufus-3.18.exe",
                   "?:\\Windows\\System32\\DriverStore\\Temp\\*.sys",
                   "?:\\Program Files (x86)\\Microsoft\\EdgeCore\\*\\BHO\\ie_to_edge_bho.dll",
                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\msedgeupdate.dll",
                   "?:\\Windows\\SysWOW64\\Macromed\\Flash\\*",
                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\MicrosoftEdgeUpdate.exe",
                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\MicrosoftEdgeUpdateBroker.exe",
                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\MicrosoftEdgeUpdateOnDemand.exe",
                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\MicrosoftEdgeUpdateComRegisterShell64.exe",
                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\MicrosoftEdgeComRegisterShellARM64.exe",
                   "?:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash.ocx",
                   "?:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil_ActiveX.dll") and
  not (process.executable : "?:\\Windows\\splwow64.exe" and file.path : "?:\\Windows\\System32\\spool\\drivers\\*") and
  not (process.executable : "?:\\Windows\\System32\\Taskmgr.exe" and file.path : "?:\\Windows\\System32\\drivers\\refs.sys-*")
  ]
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.16.0"