Potential Execution via Token Theft

Description

Identifies the creation of a process running with a token duplicate and from unbacked memory. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Query · eql

process where event.action == "start" and process.executable != null and 
 process.Ext.effective_parent.name : "?*" and process.Ext.session_info.user_flags : "LOGON_EXTRA_SIDS" and 
 process.parent.thread.Ext.call_stack_summary : 
                     ("ntdll.dll|kernelbase.dll|advapi32.dll|Unbacked", 
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|advapi32.dll|Unbacked",
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll", 
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked", 
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                      "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                      "*|seclogon.dll|*") and 
 not (process.Ext.effective_parent.executable : "?:\\Program Files*\\Dell\\SARemediation\\agent\\DellSupportAssistRemedationService.exe" and 
      process.executable : "?:\\Program Files*\\Dell\\SARemediation\\*.exe") and 
 not (process.code_signature.status : "trusted" and 
      process.code_signature.subject_name : ("LENOVO", "Dell Inc", "Citrix Systems, Inc.", "Docker Inc", "Solarwinds Worldwide, LLC", 
                                             "Binary Fortress Software Ltd", "Seagull Scientific Inc.", "Zoom Video Communications, Inc.",
                                             "Sangfor Technologies Inc.", "N-ABLE TECHNOLOGIES LTD", "LIGHT STAR INFORMATION CO.,LTD.", "Adobe Inc.")) and
 not (process.Ext.effective_parent.executable : ("?:\\Windows\\explorer.exe", "?:\\Windows\\Sys*\\sdiagnhost.exe") and 
      process.parent.thread.Ext.call_stack_summary : "*|seclogon.dll|*") and 
 not (startswith~(process.Ext.effective_parent.executable, process.executable) and process.executable : "?:\\Program Files*") and 
 not (startswith~(process.Ext.effective_parent.executable, process.parent.executable) and process.code_signature.status : "trusted" and 
      not process.code_signature.subject_name : "Microsoft*") and 
 not (process.Ext.effective_parent.name : ("dllhost.exe", "powershell.exe") and process.name : "powershell.exe" and
      process.command_line : "*CQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9*") and 
 not (process.parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe" and process.Ext.effective_parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe") and 
 not (process.parent.executable : "?:\\windows\\system32\\inetsrv\\w3wp.exe" and 
      process.Ext.effective_parent.executable : "?:\\windows\\system32\\inetsrv\\w3wp.exe") and 
 not (process.parent.name : "powershell.exe" and process.parent.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked") and 
 not process.Ext.effective_parent.executable : 
                          ("?:\\Program Files*\\Dell\\Dell Peripheral Manager\\DPM.exe", 
                           "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
                           "?:\\Windows\\System32\\sihost.exe",
                           "?:\\Windows\\System32\\ServerManager.exe",
                           "C:\\Windows\\System32\\CustomShellHost.exe",
                           "?:\\Program Files\\UniGetUI\\UniGetUI.exe",
                           "C:\\Program Files\\AcerQAAgent\\AQAUserPS.exe",
                           "?:\\Program Files\\Microsoft\\Azure Functions Core Tools\\func.exe",
                           "?:\\Windows\\System32\\oobe\\FirstLogonAnim.exe",
                           "?:\\Program Files (x86)\\vdogServer\\VDogMasterService.exe",
                           "C:\\Program Files (x86)\\Outbyte\\Driver Updater\\DriverUpdater.exe") and
 not process.executable : "?:\\Program Files (x86)\\Alternative\\QuickBooks-connector\\QuickbooksDesktopSync.exe" and
 not process.hash.sha256 :
                  ("7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664",
                   "61d372863c9cb2d83b22358c1f269b153927316b59df8093df82a497fcc40149",
                   "c42b1cdba6020d3858ce47c6a0d279045a741f21263bb417742371d0c04ae79a",
                   "90862d8b1dfc276244bcf321290388bfa56ec8102b460536286704a0e970c057",
                   "a6913e854629c944dbe43ca15fb85a56b280b0a609b323fa57154d0545b2371a",
                   "27cf7476aef249d50a205d74d5a8186187fc6447c9762c69bf1c4c9f5327db22") and
 not (process.parent.executable : ("?:\\Program Files\\PowerShell\\*\\pwsh.exe", "?:\\Program Files (x86)\\PowerShell\\*\\pwsh.exe") and 
      process.Ext.effective_parent.executable : ("?:\\Program Files\\PowerShell\\*\\pwsh.exe", "?:\\Program Files (x86)\\PowerShell\\*\\pwsh.exe")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488b5560c6420c01833d*") and
 not process.Ext.effective_parent.executable :
                               ("C:\\Program Files\\WingetUI\\UniGetUI.exe",
                                "C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe",
                                "C:\\Program Files\\Pulseway\\pcmonusertask.exe",
                                "C:\\Program Files\\Seagull\\BarTender Suite\\PrintStation.exe",
                                "C:\\Program Files\\UniGetUI\\UniGetUI.exe",
                                "C:\\Program Files (x86)\\Scalefusion\\Scalefusion MDM Agent\\bin\\OnlineClientService.exe",
                                "C:\\Program Files\\Veeam\\Endpoint Backup\\Veeam.Endpoint.RecoveryMedia.exe") and
 not (process.Ext.effective_parent.executable : "C:\\LeanServer\\SentinelRecorder\\RecordingService.exe" and
     process.executable : "C:\\Windows\\System32\\netsh.exe") and
 not process.executable : "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_*\\winget.exe" and
 not (process.executable : "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" and
      process.parent.executable : "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") and
 not process.parent.executable :
                     ("C:\\Program Files\\IIS\\Microsoft Web Deploy\\MsDepSvc.exe",
                      "C:\\Program Files\\ASUS\\ARMOURY CRATE Lite Service\\ArmouryCrate.UserSessionHelper.exe") and
 not (process.parent.executable : "C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe" and process.Ext.effective_parent.executable : "C:\\Windows\\explorer.exe") and
 not (process.name : "powershell.exe" and
      process.parent.command_line : "*AkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwA*" and
      process.Ext.effective_parent.executable : "C:\\Windows\\System32\\conhost.exe") and
 not (process.executable : "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\?.?\\AdobeARM.exe" and
      process.parent.executable : "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\?.?\\AdobeARM.exe" and process.Ext.effective_parent.executable : "C:\\Windows\\System32\\explorer.exe") and
 not (process.name : "powershell.exe" and process.command_line : "*JABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByAC4AUwBwAGwAaQB0ACgAQAAoACIAYAAwAGAAMABgADAAYAAwACIAKQ*" and
      process.Ext.effective_parent.executable : "C:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_Delta_Patch_*.exe") and
 not (process.executable : "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_*\\winget.exe" and
      process.parent.executable : "C:\\Users\\*\\AppData\\Local\\Programs\\UniGetUI\\UniGetUI.exe" and
      process.Ext.effective_parent.executable : "C:\\Users\\*\\AppData\\Local\\Programs\\UniGetUI\\UniGetUI.exe")
Raw source Potential Execution via Token Theft · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Identifies the creation of a process running with a token duplicate and from unbacked memory. Adversaries may create a
new process with a different token to escalate privileges and bypass access controls.
"""
id = "a2d5bdc0-b6e8-4d09-8bfe-ea22b7966141"
license = "Elastic License v2"
name = "Potential Execution via Token Theft"
os_list = ["windows"]
reference = [
    "https://lengjibo.github.io/token/",
    "https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw",
]
version = "1.0.20"

query = '''
process where event.action == "start" and process.executable != null and 
 process.Ext.effective_parent.name : "?*" and process.Ext.session_info.user_flags : "LOGON_EXTRA_SIDS" and 
 process.parent.thread.Ext.call_stack_summary : 
                     ("ntdll.dll|kernelbase.dll|advapi32.dll|Unbacked", 
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|advapi32.dll|Unbacked",
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll", 
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked", 
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                      "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                      "*|seclogon.dll|*") and 
 not (process.Ext.effective_parent.executable : "?:\\Program Files*\\Dell\\SARemediation\\agent\\DellSupportAssistRemedationService.exe" and 
      process.executable : "?:\\Program Files*\\Dell\\SARemediation\\*.exe") and 
 not (process.code_signature.status : "trusted" and 
      process.code_signature.subject_name : ("LENOVO", "Dell Inc", "Citrix Systems, Inc.", "Docker Inc", "Solarwinds Worldwide, LLC", 
                                             "Binary Fortress Software Ltd", "Seagull Scientific Inc.", "Zoom Video Communications, Inc.",
                                             "Sangfor Technologies Inc.", "N-ABLE TECHNOLOGIES LTD", "LIGHT STAR INFORMATION CO.,LTD.", "Adobe Inc.")) and
 not (process.Ext.effective_parent.executable : ("?:\\Windows\\explorer.exe", "?:\\Windows\\Sys*\\sdiagnhost.exe") and 
      process.parent.thread.Ext.call_stack_summary : "*|seclogon.dll|*") and 
 not (startswith~(process.Ext.effective_parent.executable, process.executable) and process.executable : "?:\\Program Files*") and 
 not (startswith~(process.Ext.effective_parent.executable, process.parent.executable) and process.code_signature.status : "trusted" and 
      not process.code_signature.subject_name : "Microsoft*") and 
 not (process.Ext.effective_parent.name : ("dllhost.exe", "powershell.exe") and process.name : "powershell.exe" and
      process.command_line : "*CQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9*") and 
 not (process.parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe" and process.Ext.effective_parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe") and 
 not (process.parent.executable : "?:\\windows\\system32\\inetsrv\\w3wp.exe" and 
      process.Ext.effective_parent.executable : "?:\\windows\\system32\\inetsrv\\w3wp.exe") and 
 not (process.parent.name : "powershell.exe" and process.parent.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked") and 
 not process.Ext.effective_parent.executable : 
                          ("?:\\Program Files*\\Dell\\Dell Peripheral Manager\\DPM.exe", 
                           "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
                           "?:\\Windows\\System32\\sihost.exe",
                           "?:\\Windows\\System32\\ServerManager.exe",
                           "C:\\Windows\\System32\\CustomShellHost.exe",
                           "?:\\Program Files\\UniGetUI\\UniGetUI.exe",
                           "C:\\Program Files\\AcerQAAgent\\AQAUserPS.exe",
                           "?:\\Program Files\\Microsoft\\Azure Functions Core Tools\\func.exe",
                           "?:\\Windows\\System32\\oobe\\FirstLogonAnim.exe",
                           "?:\\Program Files (x86)\\vdogServer\\VDogMasterService.exe",
                           "C:\\Program Files (x86)\\Outbyte\\Driver Updater\\DriverUpdater.exe") and
 not process.executable : "?:\\Program Files (x86)\\Alternative\\QuickBooks-connector\\QuickbooksDesktopSync.exe" and
 not process.hash.sha256 :
                  ("7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664",
                   "61d372863c9cb2d83b22358c1f269b153927316b59df8093df82a497fcc40149",
                   "c42b1cdba6020d3858ce47c6a0d279045a741f21263bb417742371d0c04ae79a",
                   "90862d8b1dfc276244bcf321290388bfa56ec8102b460536286704a0e970c057",
                   "a6913e854629c944dbe43ca15fb85a56b280b0a609b323fa57154d0545b2371a",
                   "27cf7476aef249d50a205d74d5a8186187fc6447c9762c69bf1c4c9f5327db22") and
 not (process.parent.executable : ("?:\\Program Files\\PowerShell\\*\\pwsh.exe", "?:\\Program Files (x86)\\PowerShell\\*\\pwsh.exe") and 
      process.Ext.effective_parent.executable : ("?:\\Program Files\\PowerShell\\*\\pwsh.exe", "?:\\Program Files (x86)\\PowerShell\\*\\pwsh.exe")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488b5560c6420c01833d*") and
 not process.Ext.effective_parent.executable :
                               ("C:\\Program Files\\WingetUI\\UniGetUI.exe",
                                "C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe",
                                "C:\\Program Files\\Pulseway\\pcmonusertask.exe",
                                "C:\\Program Files\\Seagull\\BarTender Suite\\PrintStation.exe",
                                "C:\\Program Files\\UniGetUI\\UniGetUI.exe",
                                "C:\\Program Files (x86)\\Scalefusion\\Scalefusion MDM Agent\\bin\\OnlineClientService.exe",
                                "C:\\Program Files\\Veeam\\Endpoint Backup\\Veeam.Endpoint.RecoveryMedia.exe") and
 not (process.Ext.effective_parent.executable : "C:\\LeanServer\\SentinelRecorder\\RecordingService.exe" and
     process.executable : "C:\\Windows\\System32\\netsh.exe") and
 not process.executable : "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_*\\winget.exe" and
 not (process.executable : "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" and
      process.parent.executable : "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") and
 not process.parent.executable :
                     ("C:\\Program Files\\IIS\\Microsoft Web Deploy\\MsDepSvc.exe",
                      "C:\\Program Files\\ASUS\\ARMOURY CRATE Lite Service\\ArmouryCrate.UserSessionHelper.exe") and
 not (process.parent.executable : "C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe" and process.Ext.effective_parent.executable : "C:\\Windows\\explorer.exe") and
 not (process.name : "powershell.exe" and
      process.parent.command_line : "*AkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwA*" and
      process.Ext.effective_parent.executable : "C:\\Windows\\System32\\conhost.exe") and
 not (process.executable : "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\?.?\\AdobeARM.exe" and
      process.parent.executable : "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\?.?\\AdobeARM.exe" and process.Ext.effective_parent.executable : "C:\\Windows\\System32\\explorer.exe") and
 not (process.name : "powershell.exe" and process.command_line : "*JABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByAC4AUwBwAGwAaQB0ACgAQAAoACIAYAAwAGAAMABgADAAYAAwACIAKQ*" and
      process.Ext.effective_parent.executable : "C:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_Delta_Patch_*.exe") and
 not (process.executable : "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_*\\winget.exe" and
      process.parent.executable : "C:\\Users\\*\\AppData\\Local\\Programs\\UniGetUI\\UniGetUI.exe" and
      process.Ext.effective_parent.executable : "C:\\Users\\*\\AppData\\Local\\Programs\\UniGetUI\\UniGetUI.exe")
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.001"
name = "Token Impersonation/Theft"
reference = "https://attack.mitre.org/techniques/T1134/001/"

[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.8.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.