Privilege Escalation via Windows Installer Hijack

[rule]
description = """
Identifies the creation or modification of a Windows Installer rollback script (rbs) by an unusual process followed by
the execution of process as SYSTEM. rbs files instruct the MSI service to rollback all the modification in the case of a
failed installation. This behavior can be abused by an adversary to replace a legit rbs file with a rogue one via a file
system oplock and race condition, then triggering an MSI rollback operation leading potentially to a privilege
escalation.
"""
id = "c34302d9-72ea-4d0b-8604-eec33d788448"
license = "Elastic License v2"
name = "Privilege Escalation via Windows Installer Hijack"
os_list = ["windows"]
reference = [
    "https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks",
    "https://github.com/thezdi/PoC/tree/master/FilesystemEoPs",
    "https://github.com/Wh04m1001/IFaultrepElevatedDataCollectionUAC",
    "https://foolsofsecurity.com/blog/Windows_Installer_bypass_using_rollback_script/",
]
version = "1.0.22"

query = '''
sequence with maxspan=5m
 [file where event.action != "deletion" and
  file.extension : "rbs" and file.path : "?:\\Config.msi\\*" and
  not user.id : "S-1-5-18" and
  not process.executable : ("?:\\Windows\\system32\\msiexec.exe", "?:\\Windows\\syswow64\\msiexec.exe")] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name : "system" and
  process.parent.name : "msiexec.exe" and process.parent.args : "/V"] by process.Ext.effective_parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"