Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sigma rules around using MSI for privilege escalation #5010

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

sec-hbaer
Copy link

Summary of the Pull Request

SEC Consult released a blog post about using MSI installer and repair functionality for escalating privileges (https://sec-consult.com/blog/detail/msi-installer-repair-to-system-a-detailed-journey/)
This merge request adds the sigma rules to this repo.

Changelog

new: MSI repair process completed
new: Privilege Escalation to System using MSI installers
new: Process Execution of Elevated msiexec.exe
new: Process Execution of Elevated OpenWith.exe
new: Elevated System Shell Spawned From Browser
new: Process Execution of Repair Functionality of msiexec.exe

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Sep 16, 2024
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome @sec-hbaer 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

@nasbench nasbench added the Work In Progress Some changes are needed label Sep 18, 2024
@nasbench nasbench self-assigned this Sep 18, 2024
@nasbench nasbench self-requested a review September 18, 2024 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rules Windows Pull request add/update windows related rules Work In Progress Some changes are needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants