Sunturai
Back to results
MediumSplunk security contentSteven Dick

Windows Privilege Escalation Suspicious Process Elevation

The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. This behavior is identified…

Description

The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. This behavior is identified using process execution data from Windows process monitoring. This activity is significant as it may indicate a threat actor successfully elevating privileges, which is a common tactic in advanced attacks. If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.

Detection logic

Detection requirements

Platform
ContainersIaaSIdentity ProviderLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_1_and_sysmon_eventid_1

Known benign triggers

  • False positives may be generated by administrators installing benign applications using run-as/elevation.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice