Get System Elevation

Hypothesis and description

Cyber actors frequently escalate to the SYSTEM account after gaining entry to a Windows host, to enable them to carry out various attacks more effectively. Tools such as Meterpreter, Cobalt Strike, and Empire carry out automated steps to "Get System", which is the same as switching over to the System user account. Most of these tools utilize multiple techniques to try and attain SYSTEM: in the first technique, they create a named pipe and connects an instance of cmd.exe to it, which allows them to impersonate the security context of cmd.exe, which is SYSTEM. In the second technique, a malicious DLL is injected into a process that is running as SYSTEM; the injected DLL steals the SYSTEM token and applies it where necessary to escalate privileges. This analytic looks for both of these techniques.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2021-01-15
Contributors: Sebastien Damaye

ATT&CK coverage

Technique	Tactics	Coverage
T1548 Abuse Elevation Control Mechanism	Privilege Escalation, Stealth (formerly Defense Evasion)	Moderate

1 technique. Links open MITRE ATT&CK.

T1548Abuse Elevation Control Mechanism

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PLA Process Lineage Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - Meterpreter and Cobalt StrikeData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process
suspicious_processes = filter processes where (
  (parent_image_path == C:\Windows\System32\services.exe" AND
   image_path == "C:\Windows\System32\cmd.exe" AND
   command_line == "*echo*" AND
   command_line == "*\pipe\*") OR
  (image_path == "C:\Windows\System32\rundll32.exe" AND
   command_line == "*,a /p:*"))
output suspicious_processes

PseudocodePseudocode - Empire and PoshC2Data model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process
suspicious_processes = filter processes where (
  (image_path == "C:\Windows\System32\cmd.exe" OR
   command_line == "*%COMSPEC%*") AND
   command_line == "*echo*" AND
   command_line == "*\pipe\*"))
output suspicious_processes

SplunkSplunk Search - Meterpreter and Cobalt StrikeData model: Sysmon native

Look for instances GetSystem elevation performed by Meterpreter or Cobalt Strike

index=__your_sysmon_index__ (ParentImage="C:\\Windows\\System32\\services.exe" Image="C:\\Windows\\System32\\cmd.exe" (CommandLine="*echo*" AND CommandLine="*\\pipe\\*"))
OR (Image="C:\\Windows\\System32\\rundll32.exe" CommandLine="*,a /p:*")

SplunkSplunk Search - Empire and PoshC2Data model: Sysmon native

Look for instances GetSystem elevation performed by Empire or PoshC2

index=__your_sysmon_index__ (Image="C:\\Windows\\System32\\cmd.exe" OR CommandLine="*%COMSPEC%*") (CommandLine="*echo*" AND CommandLine="*\pipe\*")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

23 more in the full list

View CAR-2021-02-002 on car.mitre.org

Hypothesis and description

ATT&CK coverage

Technique	Tactics	Coverage
T1548 Abuse Elevation Control Mechanism	Privilege Escalation, Stealth (formerly Defense Evasion)	Moderate

1 technique. Links open MITRE ATT&CK.

T1548Abuse Elevation Control Mechanism

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Pseudocode and implementations

PseudocodePseudocode - Meterpreter and Cobalt StrikeData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process
suspicious_processes = filter processes where (
  (parent_image_path == C:\Windows\System32\services.exe" AND
   image_path == "C:\Windows\System32\cmd.exe" AND
   command_line == "*echo*" AND
   command_line == "*\pipe\*") OR
  (image_path == "C:\Windows\System32\rundll32.exe" AND
   command_line == "*,a /p:*"))
output suspicious_processes

PseudocodePseudocode - Empire and PoshC2Data model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process
suspicious_processes = filter processes where (
  (image_path == "C:\Windows\System32\cmd.exe" OR
   command_line == "*%COMSPEC%*") AND
   command_line == "*echo*" AND
   command_line == "*\pipe\*"))
output suspicious_processes

SplunkSplunk Search - Meterpreter and Cobalt StrikeData model: Sysmon native

Look for instances GetSystem elevation performed by Meterpreter or Cobalt Strike

index=__your_sysmon_index__ (ParentImage="C:\\Windows\\System32\\services.exe" Image="C:\\Windows\\System32\\cmd.exe" (CommandLine="*echo*" AND CommandLine="*\\pipe\\*"))
OR (Image="C:\\Windows\\System32\\rundll32.exe" CommandLine="*,a /p:*")

SplunkSplunk Search - Empire and PoshC2Data model: Sysmon native

Look for instances GetSystem elevation performed by Empire or PoshC2

index=__your_sysmon_index__ (Image="C:\\Windows\\System32\\cmd.exe" OR CommandLine="*%COMSPEC%*") (CommandLine="*echo*" AND CommandLine="*\pipe\*")