Access Token Manipulation via Child Process

Description

Adversaries may use access tokens to operate under a different user or system security context to elevate privileges and evade detection. For example, an attacker can create a new process that runs under the security context of another user in order to perform actions they would not normally have privileges for.

Query · eql

sequence
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name in ("low", "medium", "high") and user.id != null and
  (
    /* limit to recently created files or */
    process.Ext.relative_file_creation_time < 500 or

    /* commonly abused lolbins */
    process.name : ("rundll32.exe", "regsvr32.exe", "msbuild.exe")
   ) and

  not (process.executable : "C:\\Windows\\System32\\rundll32.exe" and process.parent.name : "explorer.exe" and
       process.args : ("printui.dll,PrintUIEntryDPIAware", "cryptext.dll,CryptExtAddPFX")) and

  not (process.code_signature.trusted == true and
       process.executable :
              ("?:\\Program Files\\*",
               "?:\\Program Files (x86)\\*",
               "?:\\Users\\*",
               "?:\\ProgramData\\*",
               "?:\\Windows\\Temp\\*")) and

  not (process.name : ("wscript.exe", "cscript.exe", "powershell.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and 
  not (process.name : "regsvr32.exe" and process.args : "C:\\Windows\\System32\\mqrt.dll") and
  not (process.name : "rundll32.exe" and process.args : "22d8c27b-47a1-48d1-ad08-7da7abd79617" and process.parent.name : "dllhost.exe") and
  not process.parent.executable : "C:\\Windows\\System32\\msiexec.exe" and
  not process.parent.command_line : "C:\\Windows\\system32\\svchost.exe -k WebClientGroup" and
  not (process.parent.name : "explorer.exe" and process.executable : "\\Device\\Mup\\*.exe") and
  not (process.name : "rundll32.exe" and
       process.args : ("WSClient.dll,RefreshBannedAppsList", "xrWCbgnd.dll,LaunchBgTask", "uxtheme.dll,#64",
                       "C:\\Windows\\System32\\shell32.dll,SHCreateLocalServerRunDll", "C:\\Windows\\system32\\WerConCpl.dll,",
                       "C:\\WINDOWS\\system32\\WerConCpl.dll,", "InetCpl.cpl,ClearMyTracksByProcess",
                       "shell32.dll,SHCreateLocalServerRunDll", "Shell32.dll,Control_RunDLL")) and
  not process.parent.executable :
                      ("C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe",
                       "C:\\Program Files\\ACCUPLACER Score Client\\ACCUPLACER Score Client.exe") and
  process.hash.sha256 != "9e23e07e042943e1862b86d8c9dc05483a118938f5b19f359cb8f9aa6a14a452" and
  not (process.pe.original_file_name : "vs_*.exe" and process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
  ] by process.entity_id as event0
 [process where event.action == "start" and user.id != null and
  not process.Ext.token.integrity_level_name : "system" and

  /* running as a different user than its parent process */
  user.id != event0.user.id and

  /* common FP patterns */
  not (process.name : "rundll32.exe" and process.args : "?:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL") and

  /* non MS signed FPs */
  not (process.code_signature.subject_name :
                   ("Lenovo", "Adobe Inc.", "Brave Software, Inc.", "HP Inc.", "Splashtop Inc.", "GN AUDIO A/S",
                    "Oracle America, Inc.", "Brother Industries, Ltd.", "Bosch Automotive Service Solutions Ltd",
                    "OpenShot Studios, LLC", "CISCO SYSTEMS, INC.", "SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO)", 
                    "Wacom Co., Ltd.") and
                    process.code_signature.trusted == true) and

  not process.executable :
            ("?:\\Windows\\System32\\ntprint.exe",
             "?:\\Windows\\System32\\timeout.exe",
             "?:\\Windows\\System32\\printui.exe",
             "?:\\Windows\\System32\\SndVol.exe",
             "?:\\Windows\\System32\\MultiDigiMon.exe",
             "C:\\Windows\\SysWOW64\\vsjitdebugger.exe",
             "C:\\Windows\\System32\\shutdown.exe",
             "C:\\Windows\\System32\\WerFault.exe",
             "C:\\Windows\\System32\\OptionalFeatures.exe",
             "C:\\Windows\\System32\\conhost.exe",
             "C:\\Windows\\SysWOW64\\net1.exe",
             "C:\\Windows\\SysWOW64\\net.exe",
             "?:\\WINDOWS\\splwow64.exe",
             "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*") and
  not process.parent.executable : ("C:\\Windows\\System32\\gpscript.exe",
                                   "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
                                   "C:\\Windows\\System32\\ServerManagerLauncher.exe",
                                   "C:\\Program Files\\Accops\\AccopsSessionServerExtensions\\lspPortMapper.exe",
                                   "C:\\Windows\\SysWOW64\\Watchdata\\PROXKey CSP India V3.0\\SPSocketServer.exe") and
  not (process.pe.original_file_name : ("Bootstrapper.exe") and process.code_signature.trusted == true) and
  not process.hash.sha256 in
            ("b2b8a7156ec0079a1801db1647d6dbc4206345689772495eac311e0e6afcad57",
             "2c476f212dc61977ae3deb9319fa21242524f3b6dd30803715659a9618316089",
             "b2f6de33dc0dfd256f9708a09b853a96d5cf5bffcaf52aa1331b3b4242421667",
             "a02e0984d790393aea56252f45dd58d25cdfa4501efb40efadecd90145717c35",
             "5212286922b7b1bce5fda2c2b25a9dfdef9300736ded91350d08c837ae1e9e1c",
             "e18fbe144c938627e3c383e942e8da74ed301612d035f1e7e92557db70d05277",
             "c83ef42b6c4c85e24666c8e55b93fb64cf08164e34b85fde0270c03dd463c11f",
             "af483a6e34a9b12ed2adcdb388b50311e5c322947718a41bbc325c2d1f3a7393", 
             "bf73d2a3812ebef4f57cf81a2d24e23287cddefd57183c89535603e878eb7b11", 
             "24e76fe67435e9c7c1aa9ec22d736de3873fbd2e880d8ae716dffec0e146fc53",
             "2a12e554e19d7b59294def0c3047f77c44e8ed899d6bca264935ce03abc82abe",
             "e8f1081e08c28f80997b06f0f383957b6ece29347d042387e8ae2dcf93107adc",
             "ed7c9415508e0cb0893c77d67400ee52a0c2f54a9992d55e309b14d906fc8545",
             "ac3ea3ee1f4d7925888751c05911eaa237786346ad27637d1d4b140b08f1033c") and
  not (process.name : ("*setup*.exe", "resource_*.exe") and process.parent.name : "*.tmp" and process.executable : "?:\\Users\\*") and 
  not process.command_line : "*/SPAWNWND=*/NOTIFYWND=*" and
  not (process.pe.imphash == "acbfc62280771933334b67077d6deaba" and process.args : "-burn.elevated") and
  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
  not event0.process.hash.sha256 == process.hash.sha256 and
  not (process.executable : "C:\\Windows\\System32\\userinit.exe" and process.parent.executable : "C:\\Windows\\System32\\winlogon.exe") and
  not (process.executable : "C:\\Windows\\System32\\tabcal.exe" and process.parent.executable : "C:\\Windows\\System32\\rundll32.exe" and
       process.parent.args : "C:\\WINDOWS\\System32\\tabletpc.cpl") and
  not (process.executable : "C:\\Windows\\System32\\rdpshell.exe" and process.parent.executable : "C:\\Windows\\System32\\rdpinit.exe") and
  not (process.executable : "C:\\Windows\\System32\\rdpinit.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
  not (process.executable : ("C:\\Windows\\SysWOW64\\taskkill.exe", "C:\\Windows\\SysWOW64\\cmd.exe") and
       process.working_directory : ("C:\\Program Files (x86)\\Comhard-Plus\\UserDeskTop\\files\\",
                                    "C:\\Program Files (x86)\\TSplus\\UserDeskTop\\files\\"))
  ] by process.parent.entity_id

  until [process where event.action:"end"] by process.parent.entity_id
Raw source Access Token Manipulation via Child Process · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Adversaries may use access tokens to operate under a different user or system security context to elevate privileges and
evade detection. For example, an attacker can create a new process that runs under the security context of another user
in order to perform actions they would not normally have privileges for.
"""
id = "8bdd523d-7a18-4706-bbe0-1a2525c6979f"
license = "Elastic License v2"
name = "Access Token Manipulation via Child Process"
os_list = ["windows"]
version = "1.0.30"

query = '''
sequence
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name in ("low", "medium", "high") and user.id != null and
  (
    /* limit to recently created files or */
    process.Ext.relative_file_creation_time < 500 or

    /* commonly abused lolbins */
    process.name : ("rundll32.exe", "regsvr32.exe", "msbuild.exe")
   ) and

  not (process.executable : "C:\\Windows\\System32\\rundll32.exe" and process.parent.name : "explorer.exe" and
       process.args : ("printui.dll,PrintUIEntryDPIAware", "cryptext.dll,CryptExtAddPFX")) and

  not (process.code_signature.trusted == true and
       process.executable :
              ("?:\\Program Files\\*",
               "?:\\Program Files (x86)\\*",
               "?:\\Users\\*",
               "?:\\ProgramData\\*",
               "?:\\Windows\\Temp\\*")) and

  not (process.name : ("wscript.exe", "cscript.exe", "powershell.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and 
  not (process.name : "regsvr32.exe" and process.args : "C:\\Windows\\System32\\mqrt.dll") and
  not (process.name : "rundll32.exe" and process.args : "22d8c27b-47a1-48d1-ad08-7da7abd79617" and process.parent.name : "dllhost.exe") and
  not process.parent.executable : "C:\\Windows\\System32\\msiexec.exe" and
  not process.parent.command_line : "C:\\Windows\\system32\\svchost.exe -k WebClientGroup" and
  not (process.parent.name : "explorer.exe" and process.executable : "\\Device\\Mup\\*.exe") and
  not (process.name : "rundll32.exe" and
       process.args : ("WSClient.dll,RefreshBannedAppsList", "xrWCbgnd.dll,LaunchBgTask", "uxtheme.dll,#64",
                       "C:\\Windows\\System32\\shell32.dll,SHCreateLocalServerRunDll", "C:\\Windows\\system32\\WerConCpl.dll,",
                       "C:\\WINDOWS\\system32\\WerConCpl.dll,", "InetCpl.cpl,ClearMyTracksByProcess",
                       "shell32.dll,SHCreateLocalServerRunDll", "Shell32.dll,Control_RunDLL")) and
  not process.parent.executable :
                      ("C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe",
                       "C:\\Program Files\\ACCUPLACER Score Client\\ACCUPLACER Score Client.exe") and
  process.hash.sha256 != "9e23e07e042943e1862b86d8c9dc05483a118938f5b19f359cb8f9aa6a14a452" and
  not (process.pe.original_file_name : "vs_*.exe" and process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
  ] by process.entity_id as event0
 [process where event.action == "start" and user.id != null and
  not process.Ext.token.integrity_level_name : "system" and

  /* running as a different user than its parent process */
  user.id != event0.user.id and

  /* common FP patterns */
  not (process.name : "rundll32.exe" and process.args : "?:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL") and

  /* non MS signed FPs */
  not (process.code_signature.subject_name :
                   ("Lenovo", "Adobe Inc.", "Brave Software, Inc.", "HP Inc.", "Splashtop Inc.", "GN AUDIO A/S",
                    "Oracle America, Inc.", "Brother Industries, Ltd.", "Bosch Automotive Service Solutions Ltd",
                    "OpenShot Studios, LLC", "CISCO SYSTEMS, INC.", "SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO)", 
                    "Wacom Co., Ltd.") and
                    process.code_signature.trusted == true) and

  not process.executable :
            ("?:\\Windows\\System32\\ntprint.exe",
             "?:\\Windows\\System32\\timeout.exe",
             "?:\\Windows\\System32\\printui.exe",
             "?:\\Windows\\System32\\SndVol.exe",
             "?:\\Windows\\System32\\MultiDigiMon.exe",
             "C:\\Windows\\SysWOW64\\vsjitdebugger.exe",
             "C:\\Windows\\System32\\shutdown.exe",
             "C:\\Windows\\System32\\WerFault.exe",
             "C:\\Windows\\System32\\OptionalFeatures.exe",
             "C:\\Windows\\System32\\conhost.exe",
             "C:\\Windows\\SysWOW64\\net1.exe",
             "C:\\Windows\\SysWOW64\\net.exe",
             "?:\\WINDOWS\\splwow64.exe",
             "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*") and
  not process.parent.executable : ("C:\\Windows\\System32\\gpscript.exe",
                                   "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
                                   "C:\\Windows\\System32\\ServerManagerLauncher.exe",
                                   "C:\\Program Files\\Accops\\AccopsSessionServerExtensions\\lspPortMapper.exe",
                                   "C:\\Windows\\SysWOW64\\Watchdata\\PROXKey CSP India V3.0\\SPSocketServer.exe") and
  not (process.pe.original_file_name : ("Bootstrapper.exe") and process.code_signature.trusted == true) and
  not process.hash.sha256 in
            ("b2b8a7156ec0079a1801db1647d6dbc4206345689772495eac311e0e6afcad57",
             "2c476f212dc61977ae3deb9319fa21242524f3b6dd30803715659a9618316089",
             "b2f6de33dc0dfd256f9708a09b853a96d5cf5bffcaf52aa1331b3b4242421667",
             "a02e0984d790393aea56252f45dd58d25cdfa4501efb40efadecd90145717c35",
             "5212286922b7b1bce5fda2c2b25a9dfdef9300736ded91350d08c837ae1e9e1c",
             "e18fbe144c938627e3c383e942e8da74ed301612d035f1e7e92557db70d05277",
             "c83ef42b6c4c85e24666c8e55b93fb64cf08164e34b85fde0270c03dd463c11f",
             "af483a6e34a9b12ed2adcdb388b50311e5c322947718a41bbc325c2d1f3a7393", 
             "bf73d2a3812ebef4f57cf81a2d24e23287cddefd57183c89535603e878eb7b11", 
             "24e76fe67435e9c7c1aa9ec22d736de3873fbd2e880d8ae716dffec0e146fc53",
             "2a12e554e19d7b59294def0c3047f77c44e8ed899d6bca264935ce03abc82abe",
             "e8f1081e08c28f80997b06f0f383957b6ece29347d042387e8ae2dcf93107adc",
             "ed7c9415508e0cb0893c77d67400ee52a0c2f54a9992d55e309b14d906fc8545",
             "ac3ea3ee1f4d7925888751c05911eaa237786346ad27637d1d4b140b08f1033c") and
  not (process.name : ("*setup*.exe", "resource_*.exe") and process.parent.name : "*.tmp" and process.executable : "?:\\Users\\*") and 
  not process.command_line : "*/SPAWNWND=*/NOTIFYWND=*" and
  not (process.pe.imphash == "acbfc62280771933334b67077d6deaba" and process.args : "-burn.elevated") and
  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
  not event0.process.hash.sha256 == process.hash.sha256 and
  not (process.executable : "C:\\Windows\\System32\\userinit.exe" and process.parent.executable : "C:\\Windows\\System32\\winlogon.exe") and
  not (process.executable : "C:\\Windows\\System32\\tabcal.exe" and process.parent.executable : "C:\\Windows\\System32\\rundll32.exe" and
       process.parent.args : "C:\\WINDOWS\\System32\\tabletpc.cpl") and
  not (process.executable : "C:\\Windows\\System32\\rdpshell.exe" and process.parent.executable : "C:\\Windows\\System32\\rdpinit.exe") and
  not (process.executable : "C:\\Windows\\System32\\rdpinit.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
  not (process.executable : ("C:\\Windows\\SysWOW64\\taskkill.exe", "C:\\Windows\\SysWOW64\\cmd.exe") and
       process.working_directory : ("C:\\Program Files (x86)\\Comhard-Plus\\UserDeskTop\\files\\",
                                    "C:\\Program Files (x86)\\TSplus\\UserDeskTop\\files\\"))
  ] by process.parent.entity_id

  until [process where event.action:"end"] by process.parent.entity_id
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.6.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.