Emerging Threathightest

Exploiting SetupComplete.cmd CVE-2019-1378

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems), oscd.community, Jonhnathan RibeiroCreated Fri Nov 15Updated Sat Nov 271c373b6d-76ce-4553-997d-8c1da9a6b5f52019

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentCommandLine|contains|all:
            - '\cmd.exe'
            - '/c'
            - 'C:\Windows\Setup\Scripts\'
        ParentCommandLine|endswith:
            - 'SetupComplete.cmd'
            - 'PartnerSetupComplete.cmd'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\Setup\'
    condition: selection and not filter

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

web.archive.org

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0005 · Defense Evasion TA0004 · Privilege Escalation TA0002 · Execution

Techniques

T1068 · Exploitation for Privilege Escalation T1574 · Hijack Execution Flow

Sub-techniques

T1059.003 · Windows Command Shell

Other

cve.2019-1378detection.emerging-threats

Rule Metadata

Rule ID

1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Status

test

Level

high

Type

Emerging Threat

Created

Fri Nov 15

Modified

Sat Nov 27

Author

Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro

Path

rules-emerging-threats/2019/Exploits/CVE-2019-1378/proc_creation_win_exploit_cve_2019_1378.yml

Raw Tags

attack.persistenceattack.defense-evasionattack.privilege-escalationattack.t1068attack.executionattack.t1059.003attack.t1574cve.2019-1378detection.emerging-threats

View on GitHub