LoFP LoFP / t1068

t1068

TitleTags
a new child process of zoom isn't malicious by that fact alone. further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
exploits that were attempted but unsuccessful.
false positives may be generated by administrators installing benign applications using run-as/elevation.
false positives may be present based on common applications adding new drivers, however, filter as needed.
false positives may be present based on legitimate third party applications needing to install drivers. filter, or allow list known good drivers consistently being installed in these paths.
false positives may be present, filter as needed.
false positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. so always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
false positives may occur if there are legitimate activities that mimic the exploitation pattern. it's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
false positives will be present based on gateways in use, modify the status field as needed.
false positives will be present. filter as needed.
filter and modify the analytic as you'd like. filter based on path. remove the system32\drivers and look for non-standard paths.
if sudoedit is throwing segfaults for other reasons this will pick those up too.
if you experience a lot of fp you could comment the driver name or its exact known legitimate location (when possible)
install or update of a legitimate printing driver. verify the printer driver file metadata such as manufacturer and signature information.
legitimate use of scx runasprovider executescript.
legitimate use of scx runasprovider invoke_executeshellcommand.
other tools that use a --cpu-priority flag
scanning attempts with the abnormal use of the http post method with no indication of code execution within the http client (request) body. an example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. see description for investigation tips.
some false positives may occur with legitimate renamed process explorer binaries
some false positives may occur with legitimate renamed process monitor binaries
some legitimate printer-related processes may show up as children of spoolsv.exe. you should confirm that any activity as legitimate and may be added as exclusions in the search.
strace is a dual-use tool that can be used for benign or malicious activity. some normal use of this command may originate from developers or sres engaged in debugging or system call tracing.
this analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat.
this rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the sudo or sudoedit binaries. only sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive.
trusted system or adobe acrobat related processes.
uninstall or manual deletion of a legitimate printing driver files. verify the printer file metadata such as manufacturer and signature information.
unlikely