Registry Keys Used For Privilege Escalation
Description
This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries.
Content Mapping
This content is not mapped to any local saved search. Add mapping
Help |
---|
Registry Keys Used For Privilege Escalation HelpTo successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. |
Search |
---|
Open in Search |