Shreyas Ravikumar
@HeisenbergsrkCompletionist
0 followers2 downloads59 copies1 like1,371 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
Platforms
1
MITRE Techniques
1
1
1
Consolidated multi-stage detection for the MiniPlasma Local Privilege Escalation (LPE) flaw.
Monitors for unauthorized low-privileged modifications to the NT AUTHORITY\SYSTEM (.DEFAULT) registry hive, anomalous non-system user interaction with the Windows Cloud Files Mini Filter Driver (cldflt.sys), and successful execution of an interactive SYSTEM command shell originating from a non-privileged account context.
Monitors for unauthorized low-privileged modifications to the NT AUTHORITY\SYSTEM (.DEFAULT) registry hive, anomalous non-system user interaction with the Windows Cloud Files Mini Filter Driver (cldflt.sys), and successful execution of an interactive SYSTEM command shell originating from a non-privileged account context.
This query detects Identity Spoofing via Certificate Request, where a non-machine account (a human user) successfully requests a certificate containing a DNS Name in the Subject Alternative Name (SAN) field—an action typically reserved for servers—indicating the first step of a WSUS hijacking or server impersonation attack.