MaxPatrol SIEM

Detects cyberincidents that undermine cyber resilience of a company

T1548: Abuse Elevation Control Mechanism

Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

pt_nad: PT-CR-737: NAD_SAM_account_name_spoofing: A user requested a TGT
unix_mitre_attck_privilege_escalation: PT-CR-1663: Unix_Privilege_Escalation_via_GTFOBINS: An elevated terminal was launched using a GTFOBins utility. GTFOBins is a Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
sap_suspicious_user_activity: PT-CR-234: SAPASABAP_Debug_mode_usage: A user started the debug mode
sap_suspicious_user_activity: PT-CR-235: SAPASABAP_Development_transaction_usage: A development transaction is started
sap_suspicious_user_activity: PT-CR-251: SAPASABAP_Start_critical_report: Run of SAP critical report
active_directory_attacks: PT-CR-654: SAM_Account_Name_Spoofing: The user renamed the AD object or requested a TGT ticket on behalf of an account that matches the name of the domain controller. This may indicate a sAMAccountName spoofing attack. It can allow an attacker to obtain a TGT ticket, for example, in the name of a domain controller, gain a foothold in the system and increase their privileges
active_directory_attacks: PT-CR-831: Computer_Delegation_Configured: One of the types of delegation is configured in the domain: unlimited delegation, limited delegation, limited resource-based delegation. An attacker can use this setting to obtain users TGT or TGS tickets. After that, an attacker can elevate privileges and horizontally move to other infrastructure nodes

Detection

IDDS0002Data source and componentUser Account: User Account ModificationDescription

Log cloud API calls to assume, create, or impersonate additional roles, policies, and permissions. Review uses of just-in-time access to ensure that any justifications provided are valid and only expected actions were taken.

IDDS0009Data source and componentProcess: Process MetadataDescription

Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

IDDS0009Data source and componentProcess: Process CreationDescription

Monitor for newly executed processes that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Cyber actors frequently escalate to the SYSTEM account after gaining entry to a Windows host, to enable them to carry out various attacks more effectively. Tools such as Meterpreter, Cobalt Strike, and Empire carry out automated steps to “Get System”, which is the same as switching over to the System user account. Most of these tools utilize multiple techniques to try and attain SYSTEM: in the first technique, they create a named pipe and connects an instance of cmd.exe to it, which allows them to impersonate the security context of cmd.exe, which is SYSTEM. In the second technique, a malicious DLL is injected into a process that is running as SYSTEM; the injected DLL steals the SYSTEM token and applies it where necessary to escalate privileges. This analytic looks for both of these techniques.

Analytic 1 - Get System Elevation

(source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="WinEventLog:Security" EventCode="4688")(ParentImage="C:\Windows\System32\services.exe" Image="C:\Windows\System32\cmd.exe" CommandLine="echo" CommandLine="\pipe*") OR (Image="C:\Windows\System32\rundll32.exe" CommandLine=",a /p:*")

IDDS0009Data source and componentProcess: OS API ExecutionDescription

Also look for any process API calls for behavior that may be indicative of Process Injection. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.

IDDS0024Data source and componentWindows Registry: Windows Registry Key ModificationDescription

There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes.

IDDS0017Data source and componentCommand: Command ExecutionDescription

Monitor executed commands and arguments that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

IDDS0022Data source and componentFile: File ModificationDescription

On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the LOG_INPUT and LOG_OUTPUT directives in the /etc/sudoers file. Consider monitoring for /usr/libexec/security_authtrampoline executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called.

IDDS0022Data source and componentFile: File MetadataDescription

Monitor the file system for files that have the setuid or setgid bits set. On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).

Mitigation

IDM1038NameExecution PreventionDescription

System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.

IDM1028NameOperating System ConfigurationDescription

Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.

IDM1051NameUpdate SoftwareDescription

Perform regular software updates to mitigate exploitation risk.

IDM1052NameUser Account ControlDescription

Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking.

IDM1026NamePrivileged Account ManagementDescription

Remove users from the local administrator group on systems.

By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.

IDM1018NameUser Account ManagementDescription

Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.

IDM1047NameAuditDescription

Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.

IDM1022NameRestrict File and Directory PermissionsDescription

The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.