Query: rule covering Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
Matching passage: Sigma rule: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights. Logsource: windows / process_creation. Rule: title: PsExec/PAExec Escalation to LOCAL SYSTEM id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 related: - id: 207b0396-3689-42d9-8399-4222658efc99 type: similar status: test description: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-23 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection_sys: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' selection_other: CommandLine|contains: - psexec - paexec - accepteula condition: all of selection_* falsepositives: - Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare) - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension level: high
Near-miss passage: Sigma rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.. Logsource: windows / security. Rule: title: Startup/Logon Script Added to Group Policy Object id: 123e4e6d-b123-48f8-b261-7214938acaf0 status: test description: 'Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. ' references: - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html author: Elastic, Josh Nickels, Marius Rothenbücher date: 2024-09-06 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 - attack.t1547 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_eventid: EventID: - 5136 - 5145 selection_attributes_main: AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3 selection_attributes_optional: AttributeValue|contains: - 40B6664F-4972-11D1-A7CA-0000F87571E3 - 40B66650-4972-11D1-A7CA-0000F87571E3 selection_share: ShareName|endswith: \SYSVOL RelativeTargetName|endswith: - \scripts.ini - \psscripts.ini AccessList|contains: '%%4417' condition: selection_eventid and (all of selection_attributes_* or selection_share) falsepositives: - Legitimate execution by system administrators. level: medium