GetSystem Explained: Paths to SYSTEM-Level Access

Summary

This technical repository includes multiple Proof of Concept (PoC) tools demonstrating different approaches for obtaining SYSTEM-level privileges on Windows operating systems. The techniques cover named pipe impersonation, token stealing, service execution, scheduled task creation, and abuse of the Windows Filtering Platform. The tools are intended for educational use to help explain common Windows privilege escalation techniques.

Investigation

The repository functions as a technical collection of exploit code and usage guidance rather than a report describing a specific active compromise. It documents how various Windows services, access tokens, and privileges can be manipulated to elevate permissions.

Mitigation

Organizations should apply the principle of least privilege to prevent users and services from retaining sensitive rights such as SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege. Securing RPC endpoints, monitoring unusual service or task creation, and hardening the Windows Filtering Platform are also recommended.

Response

If execution of these PoCs is detected, security teams should investigate the originating process and the account responsible for launching the tools. Defenders should monitor for suspicious named pipe creation, unexpected service installations, and unauthorized modifications to scheduled tasks.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access to a workstation as a low-privilege user. To escalate privileges to NT AUTHORITYSYSTEM, they have downloaded the PrintSpoofer.exe exploit. The goal is to use named pipe impersonation to steal a SYSTEM token. Because the adversary is using a well-known tool, they are intentionally executing it with its original filename to test the environment’s responsiveness, thereby generating the exact Image path match required by the detection rule.

• Regression Test Script:

  # Simulation Script: Simulate execution of PrintSpoofer.exe to trigger detection
  # Note: Since we don't have the actual binary, we simulate the process creation event
  # by creating a dummy file with the specific name and "executing" it.
  
  $dummyPath = "$env:TEMPPrintSpoofer.exe"
  New-Item -Path $dummyPath -ItemType File -Force
  
  Write-Host "[!] Executing simulated PrintSpoofer.exe to trigger rule..." -ForegroundColor Yellow
  
  # In a real scenario, the tool would run. Here, we use Start-Process 
  # on the dummy file to generate the Process Creation event.
  try {
      Start-Process -FilePath $dummyPath -ErrorAction SilentlyContinue
  } catch {
      Write-Host "[*] Process started (expected error due to dummy file)" -ForegroundColor Gray
  }
  
  Write-Host "[+] Simulation command sent. Check SIEM for 'Detect Execution of System Privilege Escalation Tools'." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup: Remove the dummy exploit file
  Remove-Item -Path "$env:TEMPPrintSpoofer.exe" -Force
  Write-Host "[+] Cleanup complete." -ForegroundColor Cyan