Potential Privilege Escalation via Elevated IFileOperation

[rule]
description = """
Identifies attempts to elevate privileges by dropping a DLL file via elevated IFileOperation (Rename, Move or Copy)
followed by DLL side-loading into a process running with SYSTEM integrity. Attackers may attempt to hijack DLL search
order and stealthily execute code with elevated permissions.
"""
id = "8b4791a8-2355-4f43-8b60-d367b5c2aa51"
license = "Elastic License v2"
name = "Potential Privilege Escalation via Elevated IFileOperation"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-ifileoperation",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.34"

query = '''
sequence with maxspan=1m
  [file where event.action in ("creation", "overwrite", "rename", "modification") and

   /* IFileOperation are performed by DllHost */
   process.name : "dllhost.exe" and user.id like ("S-1-5-21*", "S-1-12-*") and

   /* executable file dropped via NewItem, Rename, Move or Copy IFileOperation */
   (file.extension : "dll" or file.Ext.header_bytes : "4d5a*") and

   /* protected system paths usually abused via DLL search order hijack */
   file.path : ("?:\\Windows\\system32\\*",
                "?:\\Windows\\syswow64\\*",
                "?:\\Program Files (x86)\\Microsoft\\*",
                "?:\\Program Files\\Microsoft\\*",
                "?:\\Program Files\\Windows *", 
                "?:\\Program Files (x86)\\Windows *")] by file.path
  [library where
   /* non MS signed */
   process.executable :
               ("?:\\Windows\\system32\\*",
                "?:\\Windows\\syswow64\\*",
                "?:\\Program Files (x86)\\Microsoft\\*",
                "?:\\Program Files\\Microsoft\\*", 
                "?:\\Program Files\\Windows *", 
                "?:\\Program Files (x86)\\Windows *") and
  not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true) and
  not startswith~(dll.name, process.name) and
  not dll.hash.sha256 :
               ("5177f7b0d88bf122b2b7e94293513cefee82970d8b5697e12821ccbe091c8e15",
                "108c16cecced0112da8095053c4efce83eeca319bf58f83412f8cf7f124a7dd5",
                "ed9ebcff2f6f28511814e726f701ab759398c3132a7382e28dd7c6ed58d32d90")] by dll.path
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.002"
name = "Bypass User Account Control"
reference = "https://attack.mitre.org/techniques/T1548/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"