Thread by @BlackMatter23

Thanks to everyone for participating in the 5th detection Quiz!
I'd like to mention @Cyb3rSn0rlax @Antonlovesdnb and @atn1ght1 - great answers folks👏
I'm starting posting answers. If you want to participate, don't look at the answers and go straight to the tweet below:

https://twitter.com/BlackMatter23/status/1414969877656391687

1. The detailed events sequence was published here:

https://twitter.com/BlackMatter23/status/1415226209387130880?s=20

1. Looking at the events sequence we see that "Medium" IL Powershell.exe spawns "Medium" IL Wusa.exe, then we see consent.exe and "High" IL Wusa start. Finally the most strange event appears - "Medium" powershell starts "High" cmd.exe🤔 What's happening here?

1. Many of you found consent.exe and guessed that activity is connected with UAC bypass. Yes, you were right. Next, what do we know about Wusa? Wusa.exe contains "autoElevate" == TRUE in it's binary manifest, therefore it is often abused for various UAC bypass techs.

1. There are currently about 70 UAC bypasses, you can find them here (for example):
github.com/hfiref0x/UACME
You ask - how can we find the right one used in the Quiz?

1. The events sequence was specially prepared for you, to avoid any other possible bypasses. So, we have powershell + Wusa + some tricky UAC bypass which lead to "High" IL process creation by "Medium" IL parent. It turns out only "Token Manipulations" bypass generates such events

1. The purpose of spawning Wusa was to further dublicate it's access token (DuplicateTokenEx), lower it to "Medium" IL (NtSetInformationToken), create filtered token (NtFilterToken), impersonate context (ImpersonateLoggedOnUser) and finally spawn the new "High" IL process.

1. The technique is also known as "Token Magic", you can find Powershell script I used here:
gist.github.com/Cr4sh/f1bebaa4…

2. Considering the 1st answer, we should map our activity to these @MITREattack techniques:
T1548.002 - Bypass UAC
T1134.001 - Token Impersonation
T1134.002 - Create Process with Token
and as PS was used:
T1059.001 - PowerShell

3. As I've already said the tool was UAC-TokenMagic:
gist.github.com/Cr4sh/f1bebaa4…

4.1 Monitor specific Powershell cmdlets execution, use EID 4104, all this token manipulation stuff will be there on Warning log level. The technique is easily detectable when powershell is used.

4.2 And what if an attacker used PE binary?
First, if you have EDR, you can look for specific to this attack API functions calls in user mode.
Second, again EDR, because there is no "parent process IL" field in EID 4688 nor in Sysmon EID 1, unfortunately☹️

4.2 Look for "High" IL powershell/cmd/LOLBins/cscript/wscript process creation by "Medium" IL parent powershell/cmd/scripts. This pattern works, I've checked in a real envs, but you need to profile your particular env, to eliminate possible FPs.
I wish you Good hunting!🎯🕸️