Detection: Windows UAC Bypass Suspicious Child Process

Description

The following analytic detects when an executable known for User Account Control (UAC) bypass exploitation spawns a child process in a user-controlled location or a command shell executable (e.g., cmd.exe, powershell.exe). This detection leverages Sysmon EventID 1 data, focusing on high or system integrity level processes with specific parent-child process relationships. This activity is significant as it may indicate an attacker has successfully used a UAC bypass exploit to escalate privileges. If confirmed malicious, this could allow the attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system.

Search

1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("high","system") AND Processes.parent_process_name IN (`uacbypass_process_name`) AND (Processes.process_name IN ("cmd.exe","powershell.exe","pwsh.exe","wscript","cscript.exe","bash.exe","werfault.exe") OR Processes.process IN ("*\\\\*","*\\Users\\*","*\\ProgramData\\*","*\\Temp\\*")) by Processes.dest, Processes.user, Processes.parent_process_guid, Processes.parent_process, Processes.parent_process_name Processes.process_name Processes.process, Processes.process_path, Processes.process_integrity_level, Processes.process_current_directory 
3| `drop_dm_object_name(Processes)` 
4| where parent_process_name != process_name 
5| `security_content_ctime(firstTime)` 
6| `security_content_ctime(lastTime)` 
7| `windows_uac_bypass_suspicious_child_process_filter`

Data Source

Name	Platform	Sourcetype	Source
CrowdStrike ProcessRollup2	N/A	'crowdstrike:events:sensor'	'crowdstrike'
Sysmon EventID 1	Windows	'xmlwineventlog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Windows Event Log Security 4688	Windows	'xmlwineventlog'	'XmlWinEventLog:Security'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

Target environment must ingest sysmon data, specifically Event ID 1 with process integrity level data.

Known False Positives

Including Werfault.exe may cause some unintended false positives related to normal application faulting, but is used in a number of UAC bypass techniques.

Associated Analytic Story

• Living Off The Land

• Windows Defense Evasion Tactics

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1548/002/

• https://atomicredteam.io/defense-evasion/T1548.002/

• https://hadess.io/user-account-control-uncontrol-mastering-the-art-of-bypassing-windows-uac/

• https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3