LOLBIN process executed with a high integrity level

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism (T1548)
Severity	Low

Description

A process spawned a suspicious LOLBIN process with a higher/system integrity level. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.

Attacker's Goals

An attacker may attempt to gain higher privileges.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that is supposed to run with privileges.

Variations

LOLBIN process executed with a high integrity level by a web server process or CGO

Synopsis

Field	Value
ATT&CK Tactic	Privilege Escalation (TA0004), Initial Access (TA0001), Persistence (TA0003)
ATT&CK Technique	Abuse Elevation Control Mechanism (T1548), External Remote Services (T1133), Server Software Component: Web Shell (T1505.003)
Severity	Medium

Description

A process spawned a suspicious LOLBIN process with a higher/system integrity level by a web server process or CGO. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.

Attacker's Goals

An attacker may attempt to gain higher privileges.

Investigative actions

• Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that is supposed to run with privileges.