Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Title: Meterpreter or Cobalt Strike Getsystem Service Installation - Security
Status: test
Description:Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  -https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
Date: 2019-10-26
modified:2023-11-15
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1134.001'
• -'attack.t1134.002'

Logsource:

• product: windows
• service: security
• definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697

Detection:
  selection_eid:
    EventID: '4697'
  selection_cli_cmd:
    ServiceFileName|contains|all:
      -'/c'
      -'echo'
      -'\pipe\'

    ServiceFileName|contains:
      -'cmd'
      -'%COMSPEC%'

  selection_cli_rundll:
    ServiceFileName|contains|all:
      -'rundll32'
      -'.dll,a'
      -'/p:'

  selection_cli_share:
    ServiceFileName|startswith: '\\\\127.0.0.1\\ADMIN$\'
  condition:selection_eid and 1 of selection_cli_*
Falsepositives:
  -Unlikely
Level: high