Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0514 — Detection Strategy for Exploitation for Privilege Escalation
DET0514

Detection Strategy for Exploitation for Privilege Escalation

4 analytic(s) · 1 technique(s) detected

Analytics

4
AN1419 Analytic 1419
Windows

Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

WinEventLog:Sysmon EventCode=6 WinEventLog:Sysmon EventCode=1 WinEventLog:Security EventCode=4672
[DriverNamePattern] Targeted BYOVD drivers may vary based on campaign and tooling.
[TimeWindow] Controls temporal linking of driver load → process spawn → privilege use.
[ParentProcessPath] Parent-child relationships vary by exploitation vector (e.g., LOLBin vs. dropper).
AN1420 Analytic 1420
Linux

Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

auditd:SYSCALL execve auditd:SYSCALL ACCESS auditd:SYSCALL dmesg
[SetUIDBinaryList] Legitimate SUID binaries vary across distributions; false positives may arise.
[TimeWindow] Allows chaining kernel module load with privilege spike or privilege-sensitive process activity.
[EffectiveUIDThreshold] Default is uid=0, but environments may vary with containerized root-like accounts.
AN1421 Analytic 1421
macOS

Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

macos:unifiedlog process:exec and kext load events macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD
[EntitlementList] Entitlements vary by app and OS version; some allow unexpected behavior.
[TimeWindow] Correlate SUID execution or AppleScript injection with privilege gain or module load.
AN1422 Analytic 1422
Containers

Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

auditd:SYSCALL capset or setns containerd:runtime e.g., containerd, Docker events
[NamespaceEscapePattern] May vary with CVE technique or custom syscall wrapper.
[TimeWindow] Controls correlation of breakout → host interaction.

Detected Techniques

1

Details

MITRE ID
DET0514
STIX ID
x-mitre-detection-strategy--64fc24f5-0428-4956-a328-2e76e0af984e
Analytics
4
Techniques Detected
1
By Tactic
Privilege Escalation
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.