CreateProcessWithTokenW Privilege Escalation Payload
This rule detects network traffic containing the strings "CreateProcessWithTokenW" and "MAXIMUM_ALLOWED" in HTTP client data. This combination of strings is indicative of a payload attempting a privilege escalation technique, specifically leveraging the Windows API function CreateProcessWithTokenW, often used in conjunction with token manipulation to achieve higher privileges. The `flow:to_client` indicates that the payload is being sent from the server to the client, suggesting a potential download or response containing the malicious code.
Suricata
