{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1068","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"df20876ce47fb340567faa0a9c32686518bfa87245cdf8d985c915f8d3ba4d96","description":"Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.\n\nWhen initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.\n\nAdversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1068","external_id":"T1068"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"},{"source_name":"Microsoft Driver Block Rules","description":"Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"},{"source_name":"Unit42 AcidBox June 2020","description":"Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.","url":"https://unit42.paloaltonetworks.com/acidbox-rare-malware/"}],"platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0091","name":"Container Enumeration","page":"telemetry/DC0091/","kind":"attack_component","category":"Container runtime","description":"Listing or inspection of container objects.","collection_focus":"Use authorized Docker API access auditing/instrumentation for list requests; a read-only inventory snapshot gives state but does not prove someone else enumerated containers.","providers":[{"name":"Docker Engine events","scope":"Daemon lifecycle events for containers and images; collect continuously.","source_id":"docker"},{"name":"Kubernetes API audit","scope":"Control-plane context in Kubernetes, not a replacement for runtime observations.","source_id":"k8s"}],"configuration":["Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.","Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.","Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website."],"configuration_example":null,"required_fields":["actor","api_operation","scope","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0091","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","api_operation":"container_list","scope":"lab-daemon","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.","sources":[{"id":"docker","title":"Docker engine event stream","url":"https://docs.docker.com/reference/cli/docker/system/events/"},{"id":"k8s","title":"Kubernetes audit policies and backends","url":"https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"}],"association":"attack_component","anomaly_design":"Per workload image and namespace: rare process starts, unexpected image/privilege changes and new network relationships. Use workload/deployment identity, not short-lived container IDs alone."},{"id":"DC0079","name":"Driver Load","page":"telemetry/DC0079/","kind":"attack_component","category":"Endpoint activity","description":"Loading of a driver into the running OS.","collection_focus":"Collect Sysmon DriverLoad (6) and retain image path, hash and signature result; distinguish load from file installation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["driver_path","action","signature_status"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0079","collector":"illustrative-lab-collector","observation":{"driver_path":"C:\\Lab\\demo.sys","action":"load","signature_status":"lab_fixture_only"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","domain":"enterprise","platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"source_url":"https://attack.mitre.org/techniques/T1068","technique_page":"techniques/enterprise/T1068/","page":"detections/enterprise/T1068/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed","title":"Possible Coin Miner CPU Priority Param","status":"test","level":"critical","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_coinminer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781","title":"Buffer Overflow Attempts","status":"test","level":"high","logsource":{"product":"linux"},"data_path":"data/detection-rules/18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_buffer_overflows.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f2bed782-994e-4f40-9cd5-518198cb3fba","title":"Linux Sudo Chroot Execution","status":"experimental","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/f2bed782-994e-4f40-9cd5-518198cb3fba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml","author":"Swachchhanda Shrawn Poudel (Nextron Systems)","kind":"sigma"},{"id":"6eea1bf6-f8d2-488a-a742-e6ef6c1b67db","title":"OMIGOD SCX RunAsProvider ExecuteScript","status":"test","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/6eea1bf6-f8d2-488a-a742-e6ef6c1b67db.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"21541900-27a9-4454-9c4c-3f0a4240344a","title":"OMIGOD SCX RunAsProvider ExecuteShellCommand","status":"test","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/21541900-27a9-4454-9c4c-3f0a4240344a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"48d91a3a-2363-43ba-a456-ca71ac3da5c2","title":"Audit CVE Event","status":"test","level":"critical","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/48d91a3a-2363-43ba-a456-ca71ac3da5c2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml","author":"Florian Roth (Nextron Systems), Zach Mathis","kind":"sigma"},{"id":"05296024-fe8a-4baf-8f3d-9a5f5624ceb2","title":"Malicious Driver Load","status":"test","level":"high","logsource":{"product":"windows","category":"driver_load"},"data_path":"data/detection-rules/05296024-fe8a-4baf-8f3d-9a5f5624ceb2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_mal_drivers.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"39b64854-5497-4b57-a448-40977b8c9679","title":"Malicious Driver Load By Name","status":"test","level":"medium","logsource":{"product":"windows","category":"driver_load"},"data_path":"data/detection-rules/39b64854-5497-4b57-a448-40977b8c9679.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_mal_drivers_names.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8","title":"Vulnerable Driver Load","status":"test","level":"high","logsource":{"product":"windows","category":"driver_load"},"data_path":"data/detection-rules/7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_vuln_drivers.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"72cd00d6-490c-4650-86ff-1d11f491daa1","title":"Vulnerable Driver Load By Name","status":"test","level":"low","logsource":{"product":"windows","category":"driver_load"},"data_path":"data/detection-rules/72cd00d6-490c-4650-86ff-1d11f491daa1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"de46c52b-0bf8-4936-a327-aace94f94ac6","title":"Process Explorer Driver Creation By Non-Sysinternals Binary","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/de46c52b-0bf8-4936-a327-aace94f94ac6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"a05baa88-e922-4001-bc4d-8738135f27de","title":"Process Monitor Driver Creation By Non-Sysinternals Binary","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/a05baa88-e922-4001-bc4d-8738135f27de.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8","title":"HKTL - SharpSuccessor Privilege Escalation Tool Execution","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"8a7e90c5-fe6e-45dc-889e-057fe4378bd9","title":"HackTool - SysmonEOP Execution","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8a7e90c5-fe6e-45dc-889e-057fe4378bd9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"dcdbc940-0bff-46b2-95f3-2d73f848e33b","title":"Suspicious Spool Service Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dcdbc940-0bff-46b2-95f3-2d73f848e33b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml","author":"Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1068-1","technique_id":"T1068","title":"T1068 Exploitation for Privilege Escalation","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#privilege-escalation","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":88,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L88","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"529cd3799606f165ca113c81fc3323df0e19dbe94514d7b47f00cd9f6f575442","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(exploit_mitigation_alert OR known_local_exploit_signature) -> ALERT; SEQUENCE(unprivileged_process, privileged_child_process) WITHIN 1m -> ALERT","log_sources":[{"title":"Memory-Protection and Exploit-Mitigation Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#12-memory-protection-and-exploit-mitigation-logs"},{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0514","name":"Detection Strategy for Exploitation for Privilege Escalation","url":"https://attack.mitre.org/detectionstrategies/DET0514","stix_id":"x-mitre-detection-strategy--64fc24f5-0428-4956-a328-2e76e0af984e","relationship_id":"relationship--d07fb93b-f652-4742-a99b-a4c99ff7b956","description":"","analytics":[{"id":"AN1419","name":"Analytic 1419","guidance":"Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1419","platforms":["Windows"],"tuning":[{"field":"DriverNamePattern","description":"Targeted BYOVD drivers may vary based on campaign and tooling."},{"field":"TimeWindow","description":"Controls temporal linking of driver load → process spawn → privilege use."},{"field":"ParentProcessPath","description":"Parent-child relationships vary by exploitation vector (e.g., LOLBin vs. dropper)."}],"log_sources":[{"component_id":"DC0079","component":"Driver Load","name":"WinEventLog:Sysmon","channel":"EventCode=6","platforms":["Windows"],"analytic_id":"AN1419","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1419","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0079/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1419","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1419","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"WinEventLog:Security","channel":"EventCode=4672","platforms":["Windows"],"analytic_id":"AN1419","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1419","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]},{"id":"AN1420","name":"Analytic 1420","guidance":"Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.","url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1420","platforms":["Linux"],"tuning":[{"field":"SetUIDBinaryList","description":"Legitimate SUID binaries vary across distributions; false positives may arise."},{"field":"TimeWindow","description":"Allows chaining kernel module load with privilege spike or privilege-sensitive process activity."},{"field":"EffectiveUIDThreshold","description":"Default is uid=0, but environments may vary with containerized root-like accounts."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1420","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1420","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0035","component":"Process Access","name":"auditd:SYSCALL","channel":"ACCESS","platforms":["Linux"],"analytic_id":"AN1420","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1420","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0016","component":"Module Load","name":"auditd:SYSCALL","channel":"dmesg","platforms":["Linux"],"analytic_id":"AN1420","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1420","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN1421","name":"Analytic 1421","guidance":"Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.","url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1421","platforms":["macOS"],"tuning":[{"field":"EntitlementList","description":"Entitlements vary by app and OS version; some allow unexpected behavior."},{"field":"TimeWindow","description":"Correlate SUID execution or AppleScript injection with privilege gain or module load."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process:exec and kext load events","platforms":["macOS"],"analytic_id":"AN1421","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1421","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_KEXTLOAD","platforms":["macOS"],"analytic_id":"AN1421","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1421","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN1422","name":"Analytic 1422","guidance":"Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.","url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1422","platforms":["Containers"],"tuning":[{"field":"NamespaceEscapePattern","description":"May vary with CVE technique or custom syscall wrapper."},{"field":"TimeWindow","description":"Controls correlation of breakout → host interaction."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"auditd:SYSCALL","channel":"capset or setns","platforms":["Containers"],"analytic_id":"AN1422","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1422","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0091","component":"Container Enumeration","name":"containerd:runtime","channel":"e.g., containerd, Docker events","platforms":["Containers"],"analytic_id":"AN1422","source_url":"https://attack.mitre.org/detectionstrategies/DET0514#AN1422","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0091/"}]}]}],"telemetry_references":[{"id":"DC0091","name":"Container Enumeration","tag":"Container Enumeration","page":"telemetry/DC0091/","kind":"attack_component"},{"id":"DC0079","name":"Driver Load","tag":"Driver Load","page":"telemetry/DC0079/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"[JHUHUGIT](https://attack.mitre.org/software/S0044) has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.(Citation: ESET Sednit Part 1)(Citation: ESET Sednit July 2015)","relationship_id":"relationship--976202db-cdfa-4c4e-bc09-9b3cad90e6fb","references":[{"source_name":"ESET Sednit Part 1","description":"ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"},{"source_name":"ESET Sednit July 2015","description":"ESET Research. (2015, July 10). Sednit APT Group Meets Hacking Team. Retrieved March 1, 2017.","url":"http://www.welivesecurity.com/2015/07/10/sednit-apt-group-meets-hacking-team/"}]},{"id":"S0050","name":"CosmicDuke","url":"https://attack.mitre.org/software/S0050","kind":"malware","description":"[CosmicDuke](https://attack.mitre.org/software/S0050) attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.(Citation: F-Secure The Dukes)","relationship_id":"relationship--63f0007e-833e-4d6a-b79e-873525979f40","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--131fde9c-7a83-4603-9c1e-c41f815fb14c","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can exploit vulnerabilities such as MS14-058.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--412a57f3-ce06-4790-8e3a-cb8c34b9e0f1","references":[{"source_name":"Cobalt Strike TTPs Dec 2017","description":"Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210924171429/https://www.cobaltstrike.com/downloads/reports/tacticstechniquesandprocedures.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0176","name":"Wingbird","url":"https://attack.mitre.org/software/S0176","kind":"malware","description":"[Wingbird](https://attack.mitre.org/software/S0176) exploits CVE-2016-4117 to allow an executable to gain escalated privileges.(Citation: Microsoft SIR Vol 21)","relationship_id":"relationship--dbccbeab-26c9-476e-b529-c193f9796cbc","references":[{"source_name":"Microsoft SIR Vol 21","description":"Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.","url":"http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--64fe312b-e489-4698-9924-aeb22c056e2b","references":[{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can exploit vulnerabilities such as MS16-032 and MS16-135.(Citation: Github PowerShell Empire)","relationship_id":"relationship--4507ba2b-e23c-4acf-a6a3-5ed9dae8d590","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.(Citation: GitHub PoshC2)","relationship_id":"relationship--248b1bfc-5f9a-4f2c-ad6c-556045d9e83b","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.(Citation: ESET Carberp March 2012)(Citation: Prevx Carberp March 2011)","relationship_id":"relationship--5fdf6cb3-8046-4c32-aca6-75cda70b7614","references":[{"source_name":"Prevx Carberp March 2011","description":"Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"},{"source_name":"ESET Carberp March 2012","description":"Matrosov, A., Rodionov, E., Volkov, D., Harley, D. (2012, March 2). Win32/Carberp When You’re in a Black Hole, Stop Digging. Retrieved July 15, 2020.","url":"https://www.eset.com/fileadmin/eset/US/resources/docs/white-papers/white-papers-win-32-carberp.pdf"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has used the BOtB tool which exploits CVE-2019-5736.(Citation: Unit 42 Hildegard Malware) ","relationship_id":"relationship--f7e5f676-46e1-4241-b0bb-fb32d891896a","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--9b7b3fc7-0151-4848-9b66-774eaf72561f","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) has leveraged a vulnerability in Windows containers to perform an [Escape to Host](https://attack.mitre.org/techniques/T1611).(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--ae5fcb43-0f85-4c96-9b4b-65fe6a19e4fb","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0654","name":"ProLock","url":"https://attack.mitre.org/software/S0654","kind":"malware","description":"[ProLock](https://attack.mitre.org/software/S0654) can use CVE-2019-0859 to escalate privileges on a compromised host.(Citation: Group IB Ransomware September 2020)","relationship_id":"relationship--d910654b-9ebe-439e-b6f9-a8234bad7961","references":[{"source_name":"Group IB Ransomware September 2020","description":"Group IB. (2020, September). LOCK LIKE  A PRO. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.(Citation: trendmicro xcsset xcode project 2020)","relationship_id":"relationship--b26307f7-2d5a-4139-8333-e2c7a583f939","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}]},{"id":"S0664","name":"Pandora","url":"https://attack.mitre.org/software/S0664","kind":"malware","description":"[Pandora](https://attack.mitre.org/software/S0664) can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--5c60473c-6195-4aa1-ae10-394bb5f24cf1","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0672","name":"Zox","url":"https://attack.mitre.org/software/S0672","kind":"malware","description":"[Zox](https://attack.mitre.org/software/S0672) has the ability to leverage local and remote exploits to escalate privileges.(Citation: Novetta-Axiom)","relationship_id":"relationship--b9ed53b8-71a5-44a3-90d1-2fb600991674","references":[{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"S1151","name":"ZeroCleare","url":"https://attack.mitre.org/software/S1151","kind":"malware","description":"[ZeroCleare](https://attack.mitre.org/software/S1151) has used a vulnerable signed VBoxDrv driver to bypass Microsoft Driver Signature Enforcement (DSE) protections and subsequently load the unsigned [RawDisk](https://attack.mitre.org/software/S0364) driver.(Citation: IBM ZeroCleare Wiper December 2019)","relationship_id":"relationship--2d61c23b-df1a-4d90-affa-b37a55b5e941","references":[{"source_name":"IBM ZeroCleare Wiper December 2019","description":"Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.","url":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"}]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","url":"https://attack.mitre.org/software/S1181","kind":"malware","description":"[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--647eae34-69ab-4cc9-aa9e-44ff570d4fd2","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has leveraged MS4Killer to deliver a vulnerable driver to the victim device, sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) has utilized the vulnerable driver probmon.sys version 3.0.0.4 which had a revoked certificated from “ITM System Co.,LTD.”(Citation: ESET Embargo Ransomware October 2024)","relationship_id":"relationship--0cdabb4e-45d7-4307-818e-0647c08a8b45","references":[{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.(Citation: Bitdefender APT28 Dec 2015)(Citation: Microsoft SIR Vol 19)(Citation: Securelist Sofacy Feb 2018)(Citation: Nearest Neighbor Volexity)","relationship_id":"relationship--cce31baa-5862-4df5-806f-15aaa7410fa5","references":[{"source_name":"Microsoft SIR Vol 19","description":"Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"},{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source_name":"Securelist Sofacy Feb 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source_name":"Nearest Neighbor Volexity","description":"Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.","url":"https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.(Citation: Unit42 AcidBox June 2020)","relationship_id":"relationship--3185e611-cec6-4910-aa64-efd8fafe1072","references":[{"source_name":"Unit42 AcidBox June 2020","description":"Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.","url":"https://unit42.paloaltonetworks.com/acidbox-rare-malware/"}]},{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has exploited CVE-2021-36934 to escalate privileges on a compromised host.(Citation: ESET T3 Threat Report 2021)","relationship_id":"relationship--2d4edddf-2870-49cb-a7ee-026b8c09fe2e","references":[{"source_name":"ESET T3 Threat Report 2021","description":"ESET. (2022, February). THREAT REPORT T3 2021. Retrieved February 10, 2022.","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Profero APT27 December 2020)","relationship_id":"relationship--0942dc11-0fcd-480a-ae4d-d571ba96331b","references":[{"source_name":"SecureWorks BRONZE UNION June 2017","description":"Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.","url":"https://www.secureworks.com/research/bronze-union"},{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.(Citation: FireEye FIN6 April 2016)","relationship_id":"relationship--74e737cf-67fb-4f80-ac4e-0ddff90b6f8e","references":[{"source_name":"FireEye FIN6 April 2016","description":"FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has exploited the Windows Kernel Elevation of Privilege vulnerability, CVE-2024-30088.(Citation: Trend Micro Earth Simnavaz October 2024)","relationship_id":"relationship--fac25fea-de44-41cd-b6e9-cd9dba5d880e","references":[{"source_name":"Trend Micro Earth Simnavaz October 2024","description":"Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) has used CVE-2016-7255 to escalate privileges.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--e0033e57-8839-42b9-8515-46e9c7dca966","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has exploited the CVE-2016-0167 local vulnerability.(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)","relationship_id":"relationship--45626c7f-c401-427b-9589-c91a4b2a4f7f","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","description":"Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy:  New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"FireEye Fin8 May 2016","description":"Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}]},{"id":"G0064","name":"APT33","url":"https://attack.mitre.org/groups/G0064","kind":"intrusion-set","description":"[APT33](https://attack.mitre.org/groups/G0064) has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.(Citation: FireEye APT33 Guardrail)","relationship_id":"relationship--f72d9afb-4eb1-4030-9d91-938f80c4bf6e","references":[{"source_name":"FireEye APT33 Guardrail","description":"Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"id":"G0068","name":"PLATINUM","url":"https://attack.mitre.org/groups/G0068","kind":"intrusion-set","description":"[PLATINUM](https://attack.mitre.org/groups/G0068) has leveraged a zero-day vulnerability to escalate privileges.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--3d4737ca-bd18-4628-b453-9aed3f555c13","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"G0080","name":"Cobalt Group","url":"https://attack.mitre.org/groups/G0080","kind":"intrusion-set","description":"[Cobalt Group](https://attack.mitre.org/groups/G0080) has used exploits to increase their levels of rights and privileges.(Citation: Group IB Cobalt Aug 2017)","relationship_id":"relationship--5bd3526a-1ae2-4b09-8be7-0eef6ae33155","references":[{"source_name":"Group IB Cobalt Aug 2017","description":"Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.","url":"https://www.group-ib.com/blog/cobalt"}]},{"id":"G0107","name":"Whitefly","url":"https://attack.mitre.org/groups/G0107","kind":"intrusion-set","description":"[Whitefly](https://attack.mitre.org/groups/G0107) has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.(Citation: Symantec Whitefly March 2019)\t","relationship_id":"relationship--76681016-c8a2-4dcf-bac5-4a58749f326d","references":[{"source_name":"Symantec Whitefly March 2019","description":"Symantec. (2019, March 6). Whitefly: Espionage Group has Singapore in Its Sights. Retrieved May 26, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted unpatched applications to elevate access in targeted organizations.(Citation: Microsoft Silk Typhoon MAR 2025)","relationship_id":"relationship--2b28f78f-fc26-44cb-bf06-fb437252d97e","references":[{"source_name":"Microsoft Silk Typhoon MAR 2025","description":"Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has exploited CVE-2017-0005 for local privilege escalation.(Citation: Check Point APT31 February 2021)","relationship_id":"relationship--cf752570-48f5-40b6-b448-b4bc009ae5df","references":[{"source_name":"Check Point APT31 February 2021","description":"Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.","url":"https://research.checkpoint.com/2021/the-story-of-jian/"}]},{"id":"G0131","name":"Tonto Team","url":"https://attack.mitre.org/groups/G0131","kind":"intrusion-set","description":"[Tonto Team](https://attack.mitre.org/groups/G0131) has exploited CVE-2019-0803 and MS16-032 to escalate privileges.(Citation: TrendMicro Tonto Team October 2020)","relationship_id":"relationship--d8d1b814-2a28-402f-ab3b-f64c6d9974ce","references":[{"source_name":"TrendMicro Tonto Team October 2020","description":"Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"id":"G1002","name":"BITTER","url":"https://attack.mitre.org/groups/G1002","kind":"intrusion-set","description":"[BITTER](https://attack.mitre.org/groups/G1002) has exploited CVE-2021-1732 for privilege escalation.(Citation: DBAPPSecurity BITTER zero-day Feb 2021)(Citation: Microsoft CVE-2021-1732 Feb 2021)","relationship_id":"relationship--81399eeb-a9f0-4e55-baed-2be3829962fe","references":[{"source_name":"DBAPPSecurity BITTER zero-day Feb 2021","description":"JinQuan, MaDongZe, TuXiaoYi, and LiHao. (2021, February 10). Windows kernel zero-day exploit (CVE-2021-1732) is used by BITTER APT in targeted attack. Retrieved June 1, 2022.","url":"https://ti.dbappsecurity.com.cn/blog/articles/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"},{"source_name":"Microsoft CVE-2021-1732 Feb 2021","description":"Microsoft. (2018, February 9). Windows Win32k Elevation of Privilege Vulnerability CVE-2021-1732. Retrieved June 1, 2022.","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.(Citation: MSTIC DEV-0537 Mar 2022)","relationship_id":"relationship--a360e9a6-541f-4026-9d50-70aa288e49ec","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).(Citation: CrowdStrike Scattered Spider BYOVD January 2023)","relationship_id":"relationship--bfe6736d-9bda-4f6e-87f9-8e6f3364a915","references":[{"source_name":"CrowdStrike Scattered Spider BYOVD January 2023","description":"CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023.","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"\n[Volt Typhoon](https://attack.mitre.org/groups/G1017) has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--736a8636-78f7-4ed7-80d4-73602eb32768","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1019","name":"MoustachedBouncer","url":"https://attack.mitre.org/groups/G1019","kind":"intrusion-set","description":"[MoustachedBouncer](https://attack.mitre.org/groups/G1019) has exploited CVE-2021-1732 to execute malware components with elevated rights.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--728302b6-f61c-40f1-9a78-926d785a3692","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.(Citation: Cisco BlackByte 2024)","relationship_id":"relationship--b61e2c68-4f0e-420d-8e58-989f8f3e83cd","references":[{"source_name":"Cisco BlackByte 2024","description":"James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)","relationship_id":"relationship--2c880ffc-9fbb-4d19-bfff-72ad6320f003","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"id":"G1058","name":"The Gentlemen","url":"https://attack.mitre.org/groups/G1058","kind":"intrusion-set","description":"[The Gentlemen](https://attack.mitre.org/groups/G1058) has assisted affiliates with gaining privilege escalation through the use of BYOVD.(Citation: BradyUnit42_TheGentlemen_July2026)","relationship_id":"relationship--1d6a8206-686c-4c52-b282-8580b3afacd5","references":[{"source_name":"BradyUnit42_TheGentlemen_July2026","description":"Brady, M. (2026, July 10). No Manners Here: The Ruthless Rise of The Gentlemen Ransomware. Retrieved September 18, 2026.","url":"https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"}]}],"mitigations":[{"id":"M1019","name":"Threat Intelligence Program","url":"https://attack.mitre.org/mitigations/M1019","kind":"course-of-action","description":"Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.","relationship_id":"relationship--c6615e27-5984-44b3-82dc-f710c6823834","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.(Citation: Microsoft Driver Block Rules)","relationship_id":"relationship--dd9a12ee-30b1-4764-860d-111c73411ebe","references":[{"source_name":"Microsoft Driver Block Rules","description":"Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"}]},{"id":"M1048","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M1048","kind":"course-of-action","description":"Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)","relationship_id":"relationship--5edeca3e-96aa-45e6-b99b-044e25cb3245","references":[{"source_name":"Ars Technica Pwn2Own 2017 VM Escape","description":"Goodin, D. (2017, March 17). Virtual machine escape fetches $105,000 at Pwn2Own hacking contest - updated. Retrieved March 12, 2018.","url":"https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"}]},{"id":"M1050","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M1050","kind":"course-of-action","description":"Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility and may not work for software components targeted for privilege escalation.","relationship_id":"relationship--267fa35c-7748-40eb-87ba-bddc0c88d643","references":[{"source_name":"TechNet Moving Beyond EMET","description":"Nunez, N. (2017, August 9). Moving Beyond EMET II – Windows Defender Exploit Guard. Retrieved March 12, 2018.","url":"https://blogs.technet.microsoft.com/srd/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"},{"source_name":"Wikipedia Control Flow Integrity","description":"Wikipedia. (2018, January 11). Control-flow integrity. Retrieved March 12, 2018.","url":"https://en.wikipedia.org/wiki/Control-flow_integrity"}]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Update software regularly by employing patch management for internal enterprise endpoints and servers.","relationship_id":"relationship--22d11711-5794-42aa-a9c5-02895fe3420d","references":[]}],"candidates":[{"id":"1c9ef3e6-bde6-402c-83bc-d89ea8bfd372","name":"Scattered Spider BYOVD (CVE-2015-2291 for Intel Ethernet Diagnostics Driver)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1068/T1068.yaml","description":"Observed TTP of threat actor Scattered Spider, where a an older, legitimate, cryptographically signed Intel driver with a known vulnerability is downloaded and run to escalate privileges\n","inputs":{"driver_path":{"description":"Path to vulnerable Intel driver","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\iqvw64e.sys"}},"dependencies":[{"description":"Intel driver must exist on disk at the specified location (#{driver_path})\n"}],"source_definition_sha256":"747f30b482fe9fe31b72a5e221eb31144d924e32a6013b16c8c245b270168657"},{"id":"97f621a5-851c-484f-b784-4a9c475006ec","name":"Turla Snake Malware Privilege Escalation Through VM Driver","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1068/T1068.yaml","description":"Observed TTP of threat actor Turla in their malware Snake, where a an older, legitimate, cryptographically signed\nVirtualBox driver with a known vulnerability is downloaded and run to escalate privileges\n\nReference: https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/\n","inputs":{"driver_path":{"description":"Path to vulnerable driver","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\vboxdrv.sys"}},"dependencies":[{"description":"Driver must exist on disk at the specified location (#{driver_path})\n"}],"source_definition_sha256":"cd8e9fc571f3a1442726b0d7f6d079d25e6b5e21b63aa4a63caedbaba9125ec2"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1105":"/ttp-simulation/techniques/enterprise/T1105/","T1570":"/ttp-simulation/techniques/enterprise/T1570/","T1068":"/ttp-simulation/techniques/enterprise/T1068/","T1611":"/ttp-simulation/techniques/enterprise/T1611/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1068","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0091","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","api_operation":"container_list","scope":"lab-daemon","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0079","collector":"illustrative-lab-collector","observation":{"driver_path":"C:\\Lab\\demo.sys","action":"load","signature_status":"lab_fixture_only"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}