Windows Access Token Manipulation Winlogon Duplicate Token Handle

Name:Windows Access Token Manipulation Winlogon Duplicate Token Handle
id:dda126d7-1d99-4f0b-b72a-4c14031f9398
version:10
date:None
author:Teoderick Contreras, Splunk
status:production
type:Hunting
Description:The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe. It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
Data_source:

• -Sysmon EventID 10

search:`sysmon`
EventCode=10
TargetImage="*:\\Windows\\system32\\winlogon.exe"

NOT SourceImage IN (
"C:\\Windows\\system32\\LogonUI.exe",
"C:\\Windows\\system32\\lsass.exe",
"C:\\Windows\\system32\\smss.exe",
"C:\\Windows\\system32\\svchost.exe",
"C:\\Windows\\system32\\wbem\\wmiprvse.exe"
)

```
Convert GrantedAccess from hexadecimal to decimal.
0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
```
| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
| eval PROCESS_DUP_HANDLE = 64
| eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
| eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE)
| eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION)
| where duplicate_handle_set == PROCESS_DUP_HANDLE
AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION

| stats count min(_time) as firstTime
max(_time) as lastTime
BY user_id dest
signature_id signature granted_access Opcode
SourceImage SourceProcessGUID SourceProcessId
TargetImage TargetProcessGUID TargetProcessId
CallTrace vendor_product

| eval CallTrace=split(CallTrace, "|")

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`

how_to_implement:To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives:It is possible legitimate applications will request access to winlogon, filter as needed.
References:
  -https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
  -https://attack.mitre.org/techniques/T1134/001/
drilldown_searches:
  :
analytic_story:['Brute Ratel C4']

asset_type:Endpoint

mitre_attack_id:['T1134.001']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  sourcetype: XmlWinEventLog
 test_type:'unit'
manual_test:None