Navigation :

Registry Keys Used For Privilege Escalation

Description

This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries.

Content Mapping

This content is not mapped to any local saved search. Add mapping

Use Case

Advanced Threat Detection

Alert Volume

SPL Difficulty

None

Journey

Stage 1

MITRE ATT&CK Tactics

Privilege Escalation

Persistence

MITRE ATT&CK Techniques

Event Triggered Execution

Image File Execution Options Injection

MITRE Threat Groups

TEMP.Veles

Kill Chain Phases

Actions On Objectives

Data Sources

Windows Security

Help
Registry Keys Used For Privilege Escalation Help To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.

Help