AN0975
Analytic 0975
Windows
Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4672
WinEventLog:Sysmon
EventCode=13, 14
[ElevatedProcessPath]
Paths to monitor for unsigned or unexpected elevated binaries
[ParentProcessName]
Parent-child execution chains that are suspicious in the local environment
[TimeWindow]
Time between registry modification and elevated process spawn
AN0976
Analytic 0976
Linux
Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.
auditd:SYSCALL
setuid or setgid bit changes
auditd:SYSCALL
execve with UID ≠ EUID
auditd:SYSCALL
sudo or pkexec invocation
[WatchedDirectories]
Paths where unauthorized setuid binaries may be dropped
[UserContext]
Which users are allowed to run sudo/pkexec or modify binaries
[TimeWindow]
Duration between file permission change and elevated command execution
AN0977
Analytic 0977
macOS
Detect execution of `/usr/libexec/security_authtrampoline` or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.
macos:unifiedlog
authorization execute privilege requests
auditd:SYSCALL
execve with escalated privileges
fs:fsusage
binary execution of security_authtrampoline
[WatchedBinaries]
Specify binaries frequently targeted for privilege escalation
[ExecutionParent]
Which applications should never be allowed to spawn elevated processes
AN0978
Analytic 0978
Identity Provider
Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.
azure:signinlogs
unusual role assumption or elevation path
[AuthorizedRoleMappings]
Roles or groups that should never be assumed outside designated paths
[TimeWindow]
Time between assertion issuance and critical privilege use
AN0979
Analytic 0979
IaaS
Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.
AWS:CloudTrail
role privilege expansion detected
AWS:CloudTrail
cross-account or unexpected assume role
[PermittedRoleTransitions]
Define valid transitions between IAM roles
[CrossAccountBoundary]
Should flag if assumption crosses trust boundary