Skip to content
Threat Feed
Subscribe

Vendor

Philandro Software GmbH

3 briefs RSS
high advisory

Process Created with an Elevated Token via Token Theft

This rule detects the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary, which adversaries may leverage to escalate privileges and bypass access controls through token theft.

privilege-escalation token-theft windows
2r 1t
high advisory

Privilege Elevation via Parent Process PID Spoofing

This rule detects parent process spoofing used to create an elevated child process, specifically targeting privilege escalation to SYSTEM, where adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges on Windows systems.

Elastic Endpoint +2 privilege-escalation windows ppid-spoofing
2r 1t
medium advisory

First Time Seen Remote Monitoring and Management Tool Execution

Detects the execution of previously unseen remote monitoring and management (RMM) tools or remote access software on compromised Windows endpoints, often leveraged for command-and-control, persistence, and execution of malicious commands.

Elastic Defend +101 remote-access rmm command-and-control persistence
3r