Back to Details

detecting-privilege-escalation-attempts

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Detecting Privilege Escalation Attempts

检测权限提升尝试

When to Use

使用场景

  • When proactively hunting for indicators of detecting privilege escalation attempts in the environment
  • After threat intelligence indicates active campaigns using these techniques
  • During incident response to scope compromise related to these techniques
  • When EDR or SIEM alerts trigger on related indicators
  • During periodic security assessments and purple team exercises
  • 主动排查环境中权限提升尝试的迹象时
  • 威胁情报显示存在使用这些技术的活跃攻击活动后
  • 事件响应期间，界定与这些技术相关的入侵范围时
  • EDR或SIEM触发相关指标警报时
  • 定期安全评估和紫队演练期间

Prerequisites

前提条件

  • EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
  • SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
  • Sysmon deployed with comprehensive configuration
  • Windows Security Event Log forwarding enabled
  • Threat intelligence feeds for IOC correlation
  • 具备进程和网络遥测功能的EDR平台（CrowdStrike、MDE、SentinelOne）
  • 已摄入相关日志数据的SIEM（Splunk、Elastic、Sentinel）
  • 部署了全面配置的Sysmon
  • 已启用Windows安全事件日志转发
  • 用于IOC关联的威胁情报源

Workflow

工作流程

  1. Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
  2. Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
  3. Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
  4. Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
  5. Validate Findings: Distinguish true positives from false positives through contextual analysis.
  6. Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
  7. Document and Report: Record findings, update detection rules, and recommend response actions.
  1. 提出假设：基于威胁情报或ATT&CK差距分析，定义可测试的假设。
  2. 确定数据源：确定验证或推翻假设所需的日志和遥测数据。
  3. 执行查询：在SIEM和EDR平台上运行检测查询，收集相关事件。
  4. 分析结果：检查查询结果中的异常情况，跨多个数据源进行关联分析。
  5. 验证发现：通过上下文分析区分真阳性和假阳性。
  6. 关联活动：将发现与更广泛的攻击链和威胁行为者TTP关联起来。
  7. 记录与报告：记录发现，更新检测规则，并推荐响应措施。

Key Concepts

核心概念

ConceptDescription
T1134Access Token Manipulation
T1548.002UAC Bypass
T1068Exploitation for Privilege Escalation
T1574.009Unquoted Service Path
概念描述
T1134访问令牌操纵
T1548.002UAC绕过
T1068利用漏洞提升权限
T1574.009未加引号的服务路径

Tools & Systems

工具与系统

ToolPurpose
CrowdStrike FalconEDR telemetry and threat detection
Microsoft Defender for EndpointAdvanced hunting with KQL
Splunk EnterpriseSIEM log analysis with SPL queries
Elastic SecurityDetection rules and investigation timeline
SysmonDetailed Windows event monitoring
VelociraptorEndpoint artifact collection and hunting
Sigma RulesCross-platform detection rule format
工具用途
CrowdStrike FalconEDR遥测与威胁检测
Microsoft Defender for Endpoint使用KQL进行高级狩猎
Splunk Enterprise使用SPL查询进行SIEM日志分析
Elastic Security检测规则与调查时间线
Sysmon详细的Windows事件监控
Velociraptor终端工件收集与狩猎
Sigma Rules跨平台检测规则格式

Common Scenarios

常见场景

  1. Scenario 1: Potato exploit for SYSTEM token impersonation
  2. Scenario 2: Fodhelper.exe UAC bypass technique
  3. Scenario 3: PrintSpoofer privilege escalation from service to SYSTEM
  4. Scenario 4: CVE kernel exploit for local privilege escalation
  1. 场景1：利用Potato漏洞模拟SYSTEM令牌
  2. 场景2：Fodhelper.exe UAC绕过技术
  3. 场景3：PrintSpoofer从服务权限提升至SYSTEM权限
  4. 场景4：利用CVE内核漏洞进行本地权限提升

Output Format

输出格式

Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1134
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1134
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]