Detectionhightest

ProcessHacker Privilege Elevation

Detects a ProcessHacker tool that elevated privileges to a very high level

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Thu May 27Updated Sun Dec 25c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9windows

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ServiceName|startswith: 'ProcessHacker'
        AccountName: 'LocalSystem'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

twitter.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0002 · Execution TA0004 · Privilege Escalation

Sub-techniques

T1543.003 · Windows Service T1569.002 · Service Execution

Rule Metadata

Rule ID

c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9

Status

test

Level

high

Type

Detection

Created

Thu May 27

Modified

Sun Dec 25

Author

Florian Roth (Nextron Systems)

Path

rules/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml

Raw Tags

attack.persistenceattack.executionattack.privilege-escalationattack.t1543.003attack.t1569.002

View on GitHub