Suspicious SeIncreaseBasePriorityPrivilege Use

Author: Elastic
Source: upstream

Identifies attempts to use the SeIncreaseBasePriorityPrivilege privilege by an unusual process. This could be related to hijack execution flow of a process via threats priority manipulation.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1134` Access Token Manipulation
Defense Evasion	`T1134` Access Token Manipulation

Event coverage

Provider	Event ID	Title
Security-Auditing	4674	An operation was attempted on a privileged object.

Stages and Predicates

Stage 1: `kql:query`

not winlog.event_data.SubjectUserSid:("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and event.category:"iam" and event.outcome:"success" and winlog.event_data.AccessMask:512 and winlog.event_data.PrivilegeList:"SeIncreaseBasePriorityPrivilege"

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

Stage	Field	Kind	Excluded values
1	`SubjectUserSid`	in	`S-1-5-18`, `S-1-5-19`, `S-1-5-20`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`event.category`	eq	`iam` corpus 2 (elastic 2)
`event.outcome`	eq	`success` corpus 8 (elastic 8)
`winlog.event_data.AccessMask`	eq	`512`
`winlog.event_data.PrivilegeList`	eq	`SeIncreaseBasePriorityPrivilege`