Potential Privilege Escalation via Service Permissions Weakness

Title: Potential Privilege Escalation via Service Permissions Weakness
Status: test
Description:Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  -https://pentestlab.blog/2017/03/31/insecure-registry-permissions/
Author: Teymur Kheirkhabarov
Date: 2019-10-26
modified:2024-12-01
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.011'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    IntegrityLevel:
      -'Medium'
      -'S-1-16-8192'

    CommandLine|contains|all:
      -'ControlSet'
      -'services'

    CommandLine|contains:
      -'\ImagePath'
      -'\FailureCommand'
      -'\ServiceDll'

  condition:selection
Falsepositives:
  -Unknown
Level: high