T1134.002 Create Process with Token
Subtécnica de T1134 Access Token Manipulation
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Meterpreter or Cobalt Strike Getsystem Service Installation - Securityhightest · windows
- Meterpreter or Cobalt Strike Getsystem Service Installation - Systemhightest · windows
- PUA - AdvancedRun Suspicious Executionhightest · windows
- Potential Meterpreter/CobaltStrike Activityhightest · windows
- Suspicious Child Process Created as Systemhightest · windows
- RedSun - Conhost.exe Spawned by TieringEngineService.exehighexperimental · windows
- PUA - AdvancedRun Executionmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.