LoFP LoFP / t1068

t1068

TitleTags
a new child process of zoom isn't malicious by that fact alone. further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
base64 encoded data in log entries
busy or noisy pods may legitimately produce bursts of kprobe events during normal operation. tune thresholds and filter by function_name to reduce false positives.
false positives may be generated by administrators installing benign applications using run-as/elevation.
false positives may be present based on common applications adding new drivers, however, filter as needed.
false positives may be present based on legitimate third party applications needing to install drivers. filter, or allow list known good drivers consistently being installed in these paths.
false positives may be present, filter as needed.
false positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. so always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
false positives may occur if there are legitimate activities that mimic the exploitation pattern. it's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
false positives will be present based on gateways in use, modify the status field as needed.
false positives will be present. filter as needed.
filter and modify the analytic as you'd like. filter based on path. remove the system32\drivers and look for non-standard paths.
if sudoedit is throwing segfaults for other reasons this will pick those up too.
if you experience a lot of fp you could comment the driver name or its exact known legitimate location (when possible)
install or update of a legitimate printing driver. verify the printer driver file metadata such as manufacturer and signature information.
legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.
legitimate af_alg usage from unprivileged users is uncommon, but some kernel crypto tests, ipsec helpers, disk encryption tooling, hsm integrations, or approved security research systems may exercise this interface. verify the process, user, and host role before adding an exception.
legitimate sandboxing, container tooling, or maintenance scripts may use unshare and spawn privileged helpers under controlled workflows. baseline approved tools and tune by host role, parent process, or user accounts.
legitimate software updates or remote imaging tools may load images from shared folders. filter these detections for approved applications to reduce false positives.
legitimate use of scx runasprovider executescript.
legitimate use of scx runasprovider invoke_executeshellcommand.
no false positives have been identified at this time.
other tools that use a --cpu-priority flag
some false positives may occur with legitimate renamed process explorer binaries
some false positives may occur with legitimate renamed process monitor binaries
some legitimate printer-related processes may show up as children of spoolsv.exe. you should confirm that any activity as legitimate and may be added as exclusions in the search.
some legitimate security tools or authorized pentesting software may use potato privilege escalation methods for testing purposes. filter alerts based on approved security testing activities.
some legitimate system cleanup or maintenance scripts may use similar foldercontentsdeletetofolderdelete commands. review and whitelist approved tools to reduce false alerts.
some legitimate system cleanup or msi uninstallation processes may delete rbs files under c:\config.msi. verify events with approved maintenance activities to reduce false alarms.
strace is a dual-use tool that can be used for benign or malicious activity. some normal use of this command may originate from developers or sres engaged in debugging or system call tracing.
system updates, scheduled backups, or misconfigured services may trigger this alert.
this analytic is meant to assist with identifying and hunting drivers loaded in the environment.
this rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the sudo or sudoedit binaries. only sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive.
trusted system or adobe acrobat related processes.
uncommon compiler activity can be due to an engineer running a local build on a production or staging instance in the course of troubleshooting or fixing a software issue.
uninstall or manual deletion of a legitimate printing driver files. verify the printer file metadata such as manufacturer and signature information.
unknown
unlikely