Windows_Exploit_Generic_e95cc41c

rule Windows_Exploit_Generic_e95cc41c {
    meta:
        author = "Elastic Security"
        id = "e95cc41c-6cad-4b9c-b647-3c60e6614e25"
        fingerprint = "3239fd6c27f8a8be66fb876ee7b28fb04013000864cc1b713ce42b05ef05af0e"
        creation_date = "2024-02-28"
        last_modified = "2024-06-12"
        threat_name = "Windows.Exploit.Generic"
        reference_sample = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
        severity = 100
        arch_context = "x86"
        scan_context = "file"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $s1 = "Got system privileges" nocase
        $s2 = "Got SYSTEM token" nocase
        $s3 = "Got a SYSTEM token" nocase
        $s4 = "] Duplicating SYSTEM token" nocase
        $s5 = "] Token Stealing is successful" nocase
        $s6 = "] Exploit completed" nocase
    condition:
        any of them
}