Home >
Enterprise >
Participants >
GoSecure >
Privilege Escalation (TA0004)
|
|
Carbanak+FIN7 |
||||
Step | ATT&CK Pattern |
|
||
4.B.5
|
|
|||
15.A.5
|
|
|||
17.A.4
|
Technique Hijack Execution Flow (T1574) Subtechnique Hijack Execution Flow: DLL Search Order Hijacking (T1574.001) |
|
Criteria
fodhelper.exe spawns cmd.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
Data Sources
- Process Monitoring


Criteria
powershell.exe spawns samcat.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
APT29 |
||||||
Step | ATT&CK Pattern |
|
||||
3.B.1
|
|
|||||
3.B.2
|
|
|||||
14.A.1
|
|
|||||
14.A.2
|
|
APT3 |
||||||
Step | ATT&CK Pattern |
|
||||
3.A.1.1
|
|
|||||
14.A.1.1
|
|
|||||
16.B.1.1
|
|
|||||
16.I.1.1
|
|
Procedure
Empire: Built-in UAC bypass token duplication module executed to launch new callback with elevated process integrity level
Footnotes
- Vendor modified configurations between scenario one and two, but MITRE assesses the change did not significantly affect results for this detection. See Configuration page for details.


Procedure
Empire: 'net use' via PowerShell to successfully authenticate to Conficker (10.0.0.5) using credentials of user Kmitnick
Footnotes
- Vendor modified configurations between scenario one and two, but MITRE assesses the change did not significantly affect results for this detection. See Configuration page for details.


[2]


Procedure
Empire: 'sc create' via PowerShell to remotely create a service on Creeper (10.0.0.4)
Footnotes
- The capability may have been modified after the start of the evaluation to create these alerts, so the detection is identified as a configuration change. See Configuration page for details.


[2]

