1type: trigger
2name: sigmahq/proc_creation_win_sysinternals_psexec_paexec_escalate_system
3description: |
4  Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains ' -s cmd' || evt.Parsed.CommandLine contains ' /s cmd' || evt.Parsed.CommandLine contains ' –s cmd' || evt.Parsed.CommandLine contains ' —s cmd' || evt.Parsed.CommandLine contains ' ―s cmd' || evt.Parsed.CommandLine contains ' -s -i cmd' || evt.Parsed.CommandLine contains ' -s /i cmd' || evt.Parsed.CommandLine contains ' -s –i cmd' || evt.Parsed.CommandLine contains ' -s —i cmd' || evt.Parsed.CommandLine contains ' -s ―i cmd' || evt.Parsed.CommandLine contains ' /s -i cmd' || evt.Parsed.CommandLine contains ' /s /i cmd' || evt.Parsed.CommandLine contains ' /s –i cmd' || evt.Parsed.CommandLine contains ' /s —i cmd' || evt.Parsed.CommandLine contains ' /s ―i cmd' || evt.Parsed.CommandLine contains ' –s -i cmd' || evt.Parsed.CommandLine contains ' –s /i cmd' || evt.Parsed.CommandLine contains ' –s –i cmd' || evt.Parsed.CommandLine contains ' –s —i cmd' || evt.Parsed.CommandLine contains ' –s ―i cmd' || evt.Parsed.CommandLine contains ' —s -i cmd' || evt.Parsed.CommandLine contains ' —s /i cmd' || evt.Parsed.CommandLine contains ' —s –i cmd' || evt.Parsed.CommandLine contains ' —s —i cmd' || evt.Parsed.CommandLine contains ' —s ―i cmd' || evt.Parsed.CommandLine contains ' ―s -i cmd' || evt.Parsed.CommandLine contains ' ―s /i cmd' || evt.Parsed.CommandLine contains ' ―s –i cmd' || evt.Parsed.CommandLine contains ' ―s —i cmd' || evt.Parsed.CommandLine contains ' ―s ―i cmd' || evt.Parsed.CommandLine contains ' -i -s cmd' || evt.Parsed.CommandLine contains ' -i /s cmd' || evt.Parsed.CommandLine contains ' -i –s cmd' || evt.Parsed.CommandLine contains ' -i —s cmd' || evt.Parsed.CommandLine contains ' -i ―s cmd' || evt.Parsed.CommandLine contains ' /i -s cmd' || evt.Parsed.CommandLine contains ' /i /s cmd' || evt.Parsed.CommandLine contains ' /i –s cmd' || evt.Parsed.CommandLine contains ' /i —s cmd' || evt.Parsed.CommandLine contains ' /i ―s cmd' || evt.Parsed.CommandLine contains ' –i -s cmd' || evt.Parsed.CommandLine contains ' –i /s cmd' || evt.Parsed.CommandLine contains ' –i –s cmd' || evt.Parsed.CommandLine contains ' –i —s cmd' || evt.Parsed.CommandLine contains ' –i ―s cmd' || evt.Parsed.CommandLine contains ' —i -s cmd' || evt.Parsed.CommandLine contains ' —i /s cmd' || evt.Parsed.CommandLine contains ' —i –s cmd' || evt.Parsed.CommandLine contains ' —i —s cmd' || evt.Parsed.CommandLine contains ' —i ―s cmd' || evt.Parsed.CommandLine contains ' ―i -s cmd' || evt.Parsed.CommandLine contains ' ―i /s cmd' || evt.Parsed.CommandLine contains ' ―i –s cmd' || evt.Parsed.CommandLine contains ' ―i —s cmd' || evt.Parsed.CommandLine contains ' ―i ―s cmd' || evt.Parsed.CommandLine contains ' -s pwsh' || evt.Parsed.CommandLine contains ' /s pwsh' || evt.Parsed.CommandLine contains ' –s pwsh' || evt.Parsed.CommandLine contains ' —s pwsh' || evt.Parsed.CommandLine contains ' ―s pwsh' || evt.Parsed.CommandLine contains ' -s -i pwsh' || evt.Parsed.CommandLine contains ' -s /i pwsh' || evt.Parsed.CommandLine contains ' -s –i pwsh' || evt.Parsed.CommandLine contains ' -s —i pwsh' || evt.Parsed.CommandLine contains ' -s ―i pwsh' || evt.Parsed.CommandLine contains ' /s -i pwsh' || evt.Parsed.CommandLine contains ' /s /i pwsh' || evt.Parsed.CommandLine contains ' /s –i pwsh' || evt.Parsed.CommandLine contains ' /s —i pwsh' || evt.Parsed.CommandLine contains ' /s ―i pwsh' || evt.Parsed.CommandLine contains ' –s -i pwsh' || evt.Parsed.CommandLine contains ' –s /i pwsh' || evt.Parsed.CommandLine contains ' –s –i pwsh' || evt.Parsed.CommandLine contains ' –s —i pwsh' || evt.Parsed.CommandLine contains ' –s ―i pwsh' || evt.Parsed.CommandLine contains ' —s -i pwsh' || evt.Parsed.CommandLine contains ' —s /i pwsh' || evt.Parsed.CommandLine contains ' —s –i pwsh' || evt.Parsed.CommandLine contains ' —s —i pwsh' || evt.Parsed.CommandLine contains ' —s ―i pwsh' || evt.Parsed.CommandLine contains ' ―s -i pwsh' || evt.Parsed.CommandLine contains ' ―s /i pwsh' || evt.Parsed.CommandLine contains ' ―s –i pwsh' || evt.Parsed.CommandLine contains ' ―s —i pwsh' || evt.Parsed.CommandLine contains ' ―s ―i pwsh' || evt.Parsed.CommandLine contains ' -i -s pwsh' || evt.Parsed.CommandLine contains ' -i /s pwsh' || evt.Parsed.CommandLine contains ' -i –s pwsh' || evt.Parsed.CommandLine contains ' -i —s pwsh' || evt.Parsed.CommandLine contains ' -i ―s pwsh' || evt.Parsed.CommandLine contains ' /i -s pwsh' || evt.Parsed.CommandLine contains ' /i /s pwsh' || evt.Parsed.CommandLine contains ' /i –s pwsh' || evt.Parsed.CommandLine contains ' /i —s pwsh' || evt.Parsed.CommandLine contains ' /i ―s pwsh' || evt.Parsed.CommandLine contains ' –i -s pwsh' || evt.Parsed.CommandLine contains ' –i /s pwsh' || evt.Parsed.CommandLine contains ' –i –s pwsh' || evt.Parsed.CommandLine contains ' –i —s pwsh' || evt.Parsed.CommandLine contains ' –i ―s pwsh' || evt.Parsed.CommandLine contains ' —i -s pwsh' || evt.Parsed.CommandLine contains ' —i /s pwsh' || evt.Parsed.CommandLine contains ' —i –s pwsh' || evt.Parsed.CommandLine contains ' —i —s pwsh' || evt.Parsed.CommandLine contains ' —i ―s pwsh' || evt.Parsed.CommandLine contains ' ―i -s pwsh' || evt.Parsed.CommandLine contains ' ―i /s pwsh' || evt.Parsed.CommandLine contains ' ―i –s pwsh' || evt.Parsed.CommandLine contains ' ―i —s pwsh' || evt.Parsed.CommandLine contains ' ―i ―s pwsh' || evt.Parsed.CommandLine contains ' -s powershell' || evt.Parsed.CommandLine contains ' /s powershell' || evt.Parsed.CommandLine contains ' –s powershell' || evt.Parsed.CommandLine contains ' —s powershell' || evt.Parsed.CommandLine contains ' ―s powershell' || evt.Parsed.CommandLine contains ' -s -i powershell' || evt.Parsed.CommandLine contains ' -s /i powershell' || evt.Parsed.CommandLine contains ' -s –i powershell' || evt.Parsed.CommandLine contains ' -s —i powershell' || evt.Parsed.CommandLine contains ' -s ―i powershell' || evt.Parsed.CommandLine contains ' /s -i powershell' || evt.Parsed.CommandLine contains ' /s /i powershell' || evt.Parsed.CommandLine contains ' /s –i powershell' || evt.Parsed.CommandLine contains ' /s —i powershell' || evt.Parsed.CommandLine contains ' /s ―i powershell' || evt.Parsed.CommandLine contains ' –s -i powershell' || evt.Parsed.CommandLine contains ' –s /i powershell' || evt.Parsed.CommandLine contains ' –s –i powershell' || evt.Parsed.CommandLine contains ' –s —i powershell' || evt.Parsed.CommandLine contains ' –s ―i powershell' || evt.Parsed.CommandLine contains ' —s -i powershell' || evt.Parsed.CommandLine contains ' —s /i powershell' || evt.Parsed.CommandLine contains ' —s –i powershell' || evt.Parsed.CommandLine contains ' —s —i powershell' || evt.Parsed.CommandLine contains ' —s ―i powershell' || evt.Parsed.CommandLine contains ' ―s -i powershell' || evt.Parsed.CommandLine contains ' ―s /i powershell' || evt.Parsed.CommandLine contains ' ―s –i powershell' || evt.Parsed.CommandLine contains ' ―s —i powershell' || evt.Parsed.CommandLine contains ' ―s ―i powershell' || evt.Parsed.CommandLine contains ' -i -s powershell' || evt.Parsed.CommandLine contains ' -i /s powershell' || evt.Parsed.CommandLine contains ' -i –s powershell' || evt.Parsed.CommandLine contains ' -i —s powershell' || evt.Parsed.CommandLine contains ' -i ―s powershell' || evt.Parsed.CommandLine contains ' /i -s powershell' || evt.Parsed.CommandLine contains ' /i /s powershell' || evt.Parsed.CommandLine contains ' /i –s powershell' || evt.Parsed.CommandLine contains ' /i —s powershell' || evt.Parsed.CommandLine contains ' /i ―s powershell' || evt.Parsed.CommandLine contains ' –i -s powershell' || evt.Parsed.CommandLine contains ' –i /s powershell' || evt.Parsed.CommandLine contains ' –i –s powershell' || evt.Parsed.CommandLine contains ' –i —s powershell' || evt.Parsed.CommandLine contains ' –i ―s powershell' || evt.Parsed.CommandLine contains ' —i -s powershell' || evt.Parsed.CommandLine contains ' —i /s powershell' || evt.Parsed.CommandLine contains ' —i –s powershell' || evt.Parsed.CommandLine contains ' —i —s powershell' || evt.Parsed.CommandLine contains ' —i ―s powershell' || evt.Parsed.CommandLine contains ' ―i -s powershell' || evt.Parsed.CommandLine contains ' ―i /s powershell' || evt.Parsed.CommandLine contains ' ―i –s powershell' || evt.Parsed.CommandLine contains ' ―i —s powershell' || evt.Parsed.CommandLine contains ' ―i ―s powershell') && (evt.Parsed.CommandLine contains 'psexec' || evt.Parsed.CommandLine contains 'paexec' || evt.Parsed.CommandLine contains 'accepteula'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1587.001
15
16  label: "PsExec/PAExec Escalation to LOCAL SYSTEM"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24