Techniques
Sample rules
Windows Handle Duplication in Known UAC-Bypass Binaries
- source: splunk
- technicques:
Description
The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path. It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE.
Detection logic
`sysmon`
EventCode=10
TargetImage IN(
"*\\colorcpl.exe",
"*\\ComputerDefaults.exe",
"*\\esentutl.exe",
"*\\eventvwr.exe",
"*\\fodhelper.exe",
"*\\mmc.exe",
"*\\sdclt.exe",
"*\\slui.exe",
"*\\wsreset.exe",
"*\\PkgMgr.exe"
)
NOT SourceImage IN (
"C:\\Windows\\System32\\*",
"C:\\Windows\\SysWOW64\\*",
"C:\\Program Files\\*",
"C:\\Program Files (x86)\\*",
"%SystemRoot%\\*"
)
| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
| eval PROCESS_DUP_HANDLE = 64
| eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE)
| where dup_handle_set == PROCESS_DUP_HANDLE
| stats count min(_time) as firstTime
max(_time) as lastTime
BY user_id dest
signature_id signature granted_access Opcode
SourceImage SourceProcessGUID SourceProcessId
TargetImage TargetProcessGUID TargetProcessId
CallTrace vendor_product
| eval CallTrace=split(CallTrace, "
|")
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_handle_duplication_in_known_uac_bypass_binaries_filter`