{"id":"bc2e25ed-b92b-4daa-b074-b502bdd1982b","title":"Local Privilege Escalation Indicator TabTip","description":"Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-10-07","modified":"2023-04-14","tags":["attack.collection","attack.execution","attack.credential-access","attack.t1557.001"],"technique_ids":["T1557.001"],"logsource":{"product":"windows","service":"system"},"falsepositives":["Unknown"],"references":["https://github.com/antonioCoco/JuicyPotatoNG"],"source_path":"rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml","source_sha256":"2709291240254cca6c1e918611e4d553a40ec709b8cbdb117f701e3b4603b8a5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Local Privilege Escalation Indicator TabTip\nid: bc2e25ed-b92b-4daa-b074-b502bdd1982b\nstatus: test\ndescription: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode\nreferences:\n    - https://github.com/antonioCoco/JuicyPotatoNG\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-10-07\nmodified: 2023-04-14\ntags:\n    - attack.collection\n    - attack.execution\n    - attack.credential-access\n    - attack.t1557.001\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        Provider_Name: 'Microsoft-Windows-DistributedCOM'\n        EventID: 10001\n        param1: 'C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe'  # Binary starting/started\n        param2: 2147943140                                                       # ERROR id\n        param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}'                         # DCOM Server\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1557.001","id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","page":"techniques/enterprise/T1557.001/"}],"data_path":"data/detection-rules/bc2e25ed-b92b-4daa-b074-b502bdd1982b.json","kind":"sigma"}