Detection rules › Sigma

Local Privilege Escalation Indicator TabTip

Severity
high
Author
Florian Roth (Nextron Systems)
Source
upstream

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
CollectionT1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Event coverage

ProviderEvent IDTitle
DistributedCOM10001Unable to start a DCOM Server: param3 as param4/param5.

Stages and Predicates

Stage 1: selection

Provider_Name: Microsoft-Windows-DistributedCOM
param1: 'C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe'
param2: 2147943140
param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Provider_Nameeq
  • Microsoft-Windows-DistributedCOM
param1eq
  • C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
param2eq
  • 2147943140
param3eq
  • {054AAE20-4BEA-4347-8A35-64A533254A9D}