name: Eventvwr UAC Bypass
  id: 9cf8fe08-7ad8-11eb-9819-acde48001122
  version: 1
  date: '2021-03-01'
  author: Michael Haag, Splunk
  type: TTP
  datamodel:
  - Endpoint
  description: The following search identifies Eventvwr bypass by identifying the registry
    modification into a specific path that eventvwr.msc looks to (but is not valid)
    upon execution. A successful attack will include a suspicious command to be executed
    upon eventvwr.msc loading. Upon triage, review the parallel processes that have
    executed. Identify any additional registry modifications on the endpoint that may
    look suspicious. Remediate as necessary.
  search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
    as registry_key_name values(Registry.registry_path) as registry_path min(_time)
    as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"  by
    Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`'
  how_to_implement: To successfully implement this search you need to be ingesting information
    on process that include the name of the process responsible for the changes from
    your endpoints into the `Endpoint` datamodel in the `Registry` node.
  known_false_positives: Some false positives may be present and will need to be filtered.
  references:
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
  - https://attack.mitre.org/techniques/T1548/002
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  tags:
    analytic_story:
    - Windows Defense Evasion Tactics
    - IcedID
    automated_detection_testing: passed
    confidence: 100
    context:
    - Source:Endpoint
    - Stage:Defense Evasion
    dataset:
    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
    impact: 80
    kill_chain_phases:
    - Exploitation
    - Privilege Escalation
    message: Registry values were modified to bypass UAC using Event Viewer on $dest$
      by $user$.
    mitre_attack_id:
    - T1548.002
    - T1548
    observable:
    - name: user
      type: User
      role:
      - Victim
    - name: dest
      type: Hostname
      role:
      - Victim
    product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
    required_fields:
    - _time
    - Registry.registry_key_name
    - Registry.registry_path
    - Registry.user
    - Registry.dest
    - Registry.registry_value_name
    risk_score: 80
    security_domain: endpoint

id: 405d5889-16c7-42e3-8865-1485d7a5b2b6
author: Patrick Bareiss
date: '2020-10-08'
description: 'Atomic Test Results: Successful Execution of test T1003.001-1 Windows
Credential Editor Successful Execution of test T1003.001-2 Dump LSASS.exe Memory
using ProcDump Return value unclear for test T1003.001-3 Dump LSASS.exe Memory using
comsvcs.dll Successful Execution of test T1003.001-4 Dump LSASS.exe Memory using
direct system calls and API unhooking Return value unclear for test T1003.001-6
Offline Credential Theft With Mimikatz Return value unclear for test T1003.001-7
LSASS read with pypykatz '
environment: attack_range
technique:
- T1003.001
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-system.log
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
- https://github.com/splunk/security-content/blob/develop/tests/T1003_001.yml
sourcetypes:
- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- WinEventLog:Microsoft-Windows-PowerShell/Operational
- WinEventLog:System
- WinEventLog:Security