AN1419
Analytic 1419
Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.
WinEventLog:Sysmon
EventCode=6
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4672
[DriverNamePattern]
Targeted BYOVD drivers may vary based on campaign and tooling.
[TimeWindow]
Controls temporal linking of driver load → process spawn → privilege use.
[ParentProcessPath]
Parent-child relationships vary by exploitation vector (e.g., LOLBin vs. dropper).
AN1420
Analytic 1420
Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.
auditd:SYSCALL
execve
auditd:SYSCALL
ACCESS
auditd:SYSCALL
dmesg
[SetUIDBinaryList]
Legitimate SUID binaries vary across distributions; false positives may arise.
[TimeWindow]
Allows chaining kernel module load with privilege spike or privilege-sensitive process activity.
[EffectiveUIDThreshold]
Default is uid=0, but environments may vary with containerized root-like accounts.
AN1421
Analytic 1421
macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.
macos:unifiedlog
process:exec and kext load events
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_KEXTLOAD
[EntitlementList]
Entitlements vary by app and OS version; some allow unexpected behavior.
[TimeWindow]
Correlate SUID execution or AppleScript injection with privilege gain or module load.
AN1422
Analytic 1422
Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.
auditd:SYSCALL
capset or setns
containerd:runtime
e.g., containerd, Docker events
[NamespaceEscapePattern]
May vary with CVE technique or custom syscall wrapper.
[TimeWindow]
Controls correlation of breakout → host interaction.