Closed sebastiendamaye closed 3 years ago
@sebastiendamaye thanks for the submission! This looks great; we'll convert to our YAML format for inclusion and will let you know if we have any questions.
Thanks again for the submission! This has been incorporated as of e527105.
CAR-2021-01-15: GetSystem in Meterpreter & Cobalt Strike & Empire & PoshC2 Beacon
This Analytics is inspired from the excellent post from RedCanary available here.
Windows Services often need this level of privilege for system management. Client management and deployment products often use
SYSTEM
to allow software installations. Security software often usesSYSTEM
to peer into the activity of other users on a system, a use case that also appeals to adversaries. When usingSYSTEM
, an adversary can monitor and manipulate data from any other user on that local computer. While this account doesn’t allow an adversary network access to log on to other computers, it does allow the adversary to execute credential access attacks against files and memory on a computer to compromise credentials for network access. This is commonly seen with attacks that use tools like Mimikatz. In the really unfortunate cases where adversaries gain access to theSYSTEM
account on Active Directory domain controllers, they can grab credentials for any users within the domain and manipulate Active Directory to add accounts for themselves.This is why many offensive security tools include a command named
getsystem
or similar. These commands make those tools try one or more things to elevate privileges to thatSYSTEM
account so the adversary can own everything on the victim host.ATT&CK Coverage
Data Model Mappings
Analytic Code
GetSystem in Meterpreter & Cobalt Strike’s Beacon
With process monitoring, hunt for processes matching these criteria:
services.exe
cmd.exe
echo
AND\pipe\
Examples:
The second
GetSystem
method usesrundll32.exe
and a few hardcoded command line options to execute a DLL for privilege escalation. Thankfully, the command line options are consistent and appear similar to this:As with named pipe impersonation, you can use process monitoring to hunt for this. Look for processes matching these criteria:
rundll32.exe
,a /p:
GetSystem in Empire & PoshC2
Example:
cmd.exe
OR%COMSPEC%
echo
AND\pipe\
Splunk Search (Splunk, Sysmon native)
Meterpreter and Cobalt Strike:
Empire and PoshC2: