Potential Fodhelper UAC Bypass ASIM Version

Back


Id	ac9e233e-44d4-45eb-b522-6e47445f6582
Rulename	Potential Fodhelper UAC Bypass (ASIM Version)
Description	This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1548.002
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/PotentialFodhelperUACBypass(ASIMVersion).yaml
Version	1.0.5
Arm template	ac9e233e-44d4-45eb-b522-6e47445f6582.json

KQL

imRegistry
  | where EventType in ("RegistryValueSet", "RegistryKeyCreated")
  | where RegistryKey has "Software\\Classes\\ms-settings\\shell\\open\\command"
  | extend TimeKey = bin(TimeGenerated, 1h)
  | join (imProcess
  | where Process endswith "fodhelper.exe"
  | where ParentProcessName endswith "cmd.exe" or ParentProcessName endswith "powershell.exe" or ParentProcessName endswith "powershell_ise.exe"
  | extend TimeKey = bin(TimeGenerated, 1h)) on TimeKey, Dvc

YAML

queryPeriod: 2h
query: |
  imRegistry
    | where EventType in ("RegistryValueSet", "RegistryKeyCreated")
    | where RegistryKey has "Software\\Classes\\ms-settings\\shell\\open\\command"
    | extend TimeKey = bin(TimeGenerated, 1h)
    | join (imProcess
    | where Process endswith "fodhelper.exe"
    | where ParentProcessName endswith "cmd.exe" or ParentProcessName endswith "powershell.exe" or ParentProcessName endswith "powershell_ise.exe"
    | extend TimeKey = bin(TimeGenerated, 1h)) on TimeKey, Dvc  
relevantTechniques:
- T1548.002
triggerOperator: gt
queryFrequency: 2h
severity: Medium
description: |
    'This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.'
metadata:
  categories:
    domains:
    - Security - Others
  author:
    name: Pete Bryan
  support:
    tier: Community
  source:
    kind: Community
triggerThreshold: 0
version: 1.0.5
tactics:
- PrivilegeEscalation
requiredDataConnectors: []
name: Potential Fodhelper UAC Bypass (ASIM Version)
id: ac9e233e-44d4-45eb-b522-6e47445f6582
kind: Scheduled
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: DvcHostname
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUsername
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/PotentialFodhelperUACBypass(ASIMVersion).yaml

ARM