Uncommon Process Access Rights For Target Image
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "sa_process_accessed" AND PROCESSNAME endswith "\calc.exe,\calculator.exe,\mspaint.exe,\notepad.exe,\ping.exe,\wordpad.exe,\write.exe" AND ACCESSRIGHT = "0x1FFFFF" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME,Action1.SRCUSER,Action1.TARGETUSER,Action1.CALLTRACE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems), frack113
