Query: rule covering Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
Matching passage: Sigma rule: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege. Logsource: windows / process_creation. Rule: title: Always Install Elevated Windows Installer id: cd951fdc-4b2f-47f5-ba99-a33bf61e3770 status: test description: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_user: User|contains: - AUTHORI - AUTORI selection_image_1: Image|contains|all: - \Windows\Installer\ - msi Image|endswith: tmp selection_image_2: Image|endswith: \msiexec.exe IntegrityLevel: - System - S-1-16-16384 filter_installer: ParentImage: C:\Windows\System32\services.exe filter_repair: - CommandLine|endswith: \system32\msiexec.exe /V - ParentCommandLine|endswith: \system32\msiexec.exe /V filter_sophos: ParentImage|startswith: C:\ProgramData\Sophos\ filter_avira: ParentImage|startswith: C:\ProgramData\Avira\ filter_avast: ParentImage|startswith: - C:\Program Files\Avast Software\ - C:\Program Files (x86)\Avast Software\ filter_google_update: ParentImage|startswith: - C:\Program Files\Google\Update\ - C:\Program Files (x86)\Google\Update\ condition: 1 of selection_image_* and selection_user and not 1 of filter_* falsepositives: - System administrator usage - Anti virus products - WindowsApps located in "C:\Program Files\WindowsApps\" level: medium
Near-miss passage: Sigma rule: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lat. Logsource: windows / security. Rule: title: CobaltStrike Service Installations - Security id: d7a95147-145f-4678-b85d-d1ff4a3bb3f6 related: - id: 5a105d34-05fc-401e-8553-272b45c1522d type: derived status: test description: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement references: - https://www.sans.org/webcasts/119395 - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-26 modified: 2022-11-27 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.lateral-movement - attack.t1021.002 - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: event_id: EventID: 4697 selection1: ServiceFileName|contains|all: - ADMIN$ - .exe selection2: ServiceFileName|contains|all: - '%COMSPEC%' - start - powershell selection3: ServiceFileName|contains: powershell -nop -w hidden -encodedcommand selection4: ServiceFileName|base64offset|contains: 'IEX (New-Object Net.Webclient).DownloadString(''http://127.0.0.1:' condition: event_id and 1 of selection* falsepositives: - Unknown level: high