Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1068-exploitation-for-privilege-escalation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect events where an unauthorized attempt to escalate privileges was blocked or identified by Trellix Endpoint Security.

Strategy

Monitor for unauthorized attempts to gain higher levels of access or privileges on an endpoint. These events may indicate malicious activity, such as an attacker trying to elevate privileges to gain unauthorized control over systems, which could lead to further compromise or exploitation of sensitive data.

Triage and Response

1. Confirm the details of the privilege escalation attempt, including the user or process that initiated it.
2. Review the event details to understand the nature of the privilege escalation attempt, such as the method used.
3. Examine the impacted endpoint using its hostname - {{@attributes.analyzerhostname}} and IP address - {{@attributes.analyzeripv4}} to investigate potential vulnerabilities.
4. If the escalation attempt indicates a security threat, take immediate action to isolate the endpoint and perform a thorough investigation of potential unauthorized access.
5. Ensure that user privileges are correctly assigned and review existing security policies to prevent similar attempts in the future.