
title: Meterpreter or Cobalt Strike Getsystem Service Start
author: Teymur Kheirkhabarov, Ecco, Florian Roth
date: 2019/10/26
description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting
  a specific service starting
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_10:
    CommandLine: '*\pipe\\*'
  SELECTION_11:
    CommandLine: '*cmd.exe*'
  SELECTION_12:
    CommandLine: '*/c*'
  SELECTION_13:
    CommandLine: '*echo*'
  SELECTION_14:
    CommandLine: '*\pipe\\*'
  SELECTION_15:
    CommandLine: '*rundll32*'
  SELECTION_16:
    CommandLine: '*.dll,a*'
  SELECTION_17:
    CommandLine: '*/p:*'
  SELECTION_18:
    CommandLine: '*MpCmdRun*'
  SELECTION_2:
    ParentImage: '*\services.exe'
  SELECTION_3:
    CommandLine: '*cmd*'
  SELECTION_4:
    CommandLine: '*/c*'
  SELECTION_5:
    CommandLine: '*echo*'
  SELECTION_6:
    CommandLine: '*\pipe\\*'
  SELECTION_7:
    CommandLine: '*%COMSPEC%*'
  SELECTION_8:
    CommandLine: '*/c*'
  SELECTION_9:
    CommandLine: '*echo*'
  condition: (SELECTION_1 and (SELECTION_2 and ((SELECTION_3 and SELECTION_4 and SELECTION_5
    and SELECTION_6) or (SELECTION_7 and SELECTION_8 and SELECTION_9 and SELECTION_10)
    or (SELECTION_11 and SELECTION_12 and SELECTION_13 and SELECTION_14) or (SELECTION_15
    and SELECTION_16 and SELECTION_17))) and  not (SELECTION_18))
falsepositives:
- Commandlines containing components like cmd accidentally
- Jobs and services started with cmd
fields:
- ComputerName
- User
- CommandLine
id: 15619216-e993-4721-b590-4c520615a67d
level: high
logsource:
  category: process_creation
  product: windows
modified: 2021/05/20
references:
- https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
- https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
status: experimental
tags:
- attack.privilege_escalation
- attack.t1134
- attack.t1134.001
- attack.t1134.002
ruletype: SIGMA
