SOC Prime cultivates collaboration from a global cybersecurity community and curates the most up-to-date Sigma rules aligned with the MITRE ATT&CK® framework enabling teams to focus on threats they anticipate most. With the recently released On Demand subscriptions for SOC Prime’s platform, security practitioners can gain immediate access to detection-as-code content matching the attack vectors most relevant to their organization-specific needs. In this blog article, we are going to cover the Privilege Escalation (TA0004) tactic overview and analysis and explore dedicated Sigma rules addressing this ATT&CK tactic.
Adversaries have different goals but they generally affect the confidentiality, integrity, or availability of critical systems. Privilege escalation is the act of obtaining higher trusts within a compromised system. These trusts allow them to take further action, such as laterally moving to new hosts, or taking privileged actions like reading or changing protected data.
Detecting privilege escalation is a complex process that cannot be limited to a single rule and requires multiple detection algorithms while considering new techniques, tools, and implementations as soon as they arise.
Sigma serves as a de-facto standard for expressing threat hunting queries that can be used to develop detection content applicable to most popular SIEM & XDR solutions. Visit the Sigma repository on GitHub or for more details or explore how Sigma transforms cybersecurity as a vendor-agnostic and future-proof industry standard.
Leveraging Uncoder.IO, teams can instantly translate Sigma rules to the security solution of their choice. Alternatively, using the command-line interface, Sigma rules can be converted to the selected language format via SIGMAC tool.
Below you can find our recommended Sigma rules addressing the Privilege Escalation tactic (TA0004):
Behavior Rule: Windows Debug Privileges Assigned
SeDebugPrivilege is a privilege within Windows that allows adversaries to escalate to the local system account (Windows equivalent of root) by debugging system processes. This rule identifies accounts being assigned the SeDebugPrivilege.
CVE-2022-0847 (Dirty Pipe) is a vulnerability that allows a non-root user to overwrite data in any target file. This rule leverages syscall events from auditd to identify probable exploitation attempts.
AdvancedRun is a freeware tool provided by the software developer Nir Sofer. The tool has been used by threat actrors to escalate from a local administrator to system privileges.
Azure Apps can be granted the App role “AppRoleAssignment.ReadWrite.All”. With this permission, an app can provide itself any API permission, including the ability to change user roles to Global Admin. This rule identifies apps being granted sensitive App role permissions.
Sigma rules available in the SOC Prime’s platform covers log sources tailored to the organization’s environment. Here are five most common log sources normally required to detect privilege escalation.
Below you can find the most common process creation log sources:
It is common for adversaries to create services and tasks for privilege escalation. Services run with system privileges, and scheduled tasks can be made by administrators. Scheduled tasks are normally created to run as SYSTEM and then are deleted in a short amount of time.
Here are some common service and scheduled task creation data sources:
When user roles are changed, the cloud providers generally log these changes in Identity and Access Management Logs. For instance, Google Cloud Provider includes IAM logs in their Cloud Audit Logs.
When users access or change cloud resources in the cloud, an audit log is generally created showing the access. For instance, AWS provides CloudTrail logs, while Microsoft — AzureActivity logs. The appropriate activity logs can help security practitioners audit access to sensitive resources.
Monitor for activity from the root account using auditd or an equivalent feature provided by an EDR / XDR.
SOC Prime curates detections mainly generated from two primary sources that combine to produce collaborative expertise enabling teams to keep pace with the ever-increasing attack volume. Both the SOC Prime’s in-house team of content developers and Threat Bounty Program researchers, including Emir Erdogan, Osman Demir, Nattatorn Chuensangarun, and Sittikorn Sangrattanapitak, have mainly contributed to the delivery of detection content addressing the Privilege Escalation tactic.
Fig. 1. Sigma rules addressing the Privilege Escalation (TA0004) tactic along with translations to 25+ supported platforms
The newly released On Demand subscriptions are designed to enable security practitioners to drive immediate value from SOC Prime’s platform by offering direct access to detection content matching the organization-specific threat profile. As part of these subscriptions, teams can gain instant access to 1,400+ Sigma-based detection rules addressing the Privilege Escalation tactic along with translations available for 25+ SIEM & XDR formats. For more details on the On Demand subscription tiers, please refer to https://my.socprime.com/pricing/.