Uncommon Process Access Rights For Target Image

Title: Uncommon Process Access Rights For Target Image
Status: test
Description:Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
References:
  -https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-05-27
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055.011'

Logsource:

• category: process_access
• product: windows

Detection:
  selection:
    TargetImage|endswith:
      -'\calc.exe'
      -'\calculator.exe'
      -'\mspaint.exe'
      -'\notepad.exe'
      -'\ping.exe'
      -'\wordpad.exe'
      -'\write.exe'

    GrantedAccess: '0x1FFFFF'
  condition:selection
Falsepositives:
  -Unknown
Level: low