Analytics Story: Windows Privilege Escalation

Created: 2019-10-16 Last Updated: 2026-05-13 ID: 644e22d3-598a-429c-a007-16fdb802cae5 Author: David Dorsey, Splunk Product: Splunk Enterprise Security

Description

Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.

Why it matters

Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Suspicious Defender Engine or Signature Files Created	Exploitation for Privilege Escalation	Anomaly
Windows MSI Rollback Script Deleted By Non-Msiexec Process	Exploitation for Privilege Escalation, Msiexec	TTP
Logon Script Event Trigger Execution	Logon Script (Windows)	TTP
MSI Module Loaded by Non-System Binary	DLL	Hunting
Windows MsMpEng Writing to System32	Exploitation for Privilege Escalation, Windows Service	TTP
Windows Privilege Escalation Attempt Via MSI Rollback	Exploitation for Privilege Escalation	TTP
Print Processor Registry Autostart	Print Processors	TTP
Windows Privilege Escalation Suspicious Process Elevation	Exploitation for Privilege Escalation, Access Token Manipulation, Abuse Elevation Control Mechanism	TTP
Windows Privilege Escalation System Process Without System Parent	Exploitation for Privilege Escalation, Access Token Manipulation, Abuse Elevation Control Mechanism	TTP
Windows Phantom DLL Created on Disk	Exploitation for Privilege Escalation, DLL	TTP
Windows Non-System Process Querying Definition Update	Exploitation for Privilege Escalation, Web Protocols	Anomaly
Windows Mock Trusted Directory MSC File Creation	MMC, Bypass User Account Control, Hijack Execution Flow	TTP
Windows Defender Intermediary Artifact Was Observed	Exploitation for Privilege Escalation	Anomaly
Windows Potato Privilege Escalation Tool Execution	Exploitation for Privilege Escalation	TTP
Windows New Default File Association Value Set	Change Default File Association	Hunting
Windows Wermgr Spawning System Integrity Process	Exploitation for Privilege Escalation, Token Impersonation/Theft	TTP
Windows AppCertDLL Modification Via Registry	AppCert DLLs	Anomaly
ETW Registry Disabled	Trusted Developer Utilities Proxy Execution, Disable or Modify Tools	TTP
Runas Execution in CommandLine	Token Impersonation/Theft	Hunting
Windows Error Report Created in ReportQueue Manually	Scheduled Task, Exploitation for Privilege Escalation	Anomaly
Windows Admin Password Changed by Non-Admin	Exploitation for Privilege Escalation, Windows Service	TTP
Screensaver Event Trigger Execution	Screensaver	TTP
Overwriting Accessibility Binaries	Accessibility Features	TTP
Time Provider Persistence Registry	Time Providers	TTP
Windows Suspicious Burst of Password Changes	Exploitation for Privilege Escalation	TTP
Windows Suspicious Child Process of TieringEngineService.exe	Exploitation for Privilege Escalation	TTP
Kerberoasting spn request with RC4 encryption	Kerberoasting	TTP
Windows VSSVC Process Accessing Defender Engine	Exploitation for Privilege Escalation	TTP
Windows Privilege Escalation User Process Spawn System Process	Exploitation for Privilege Escalation, Access Token Manipulation, Abuse Elevation Control Mechanism	TTP
Windows SCCM Adsource DLL Was Planted In SMS Provider Directory	DLL Side-Loading	TTP
Windows SymbolicLink-Testing-Tools Utility Execution	File and Directory Permissions Modification, NTFS File Attributes	TTP
Windows Cloud Files Filter Log Created by Non-System Process	Exploitation for Privilege Escalation	TTP
Child Processes of Spoolsv exe	Exploitation for Privilege Escalation	TTP
Active Setup Registry Autostart	Active Setup	TTP
Registry Keys Used For Privilege Escalation	Image File Execution Options Injection	TTP
Windows Suspicious Child Process of Consent.EXE	Command and Scripting Interpreter, Exploitation for Privilege Escalation, Bypass User Account Control	Anomaly
Windows SCCM Smsexec Spawned a Suspicious Child Process	Exploitation for Privilege Escalation, DLL	Anomaly
Windows AppCertDLL Modification Via Command Line	AppCert DLLs	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 26	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 15	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4723	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4724	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4769	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 10	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

https://attack.mitre.org/tactics/TA0004/

Source: GitHub | Version: 3