Windows CVE-2019-1388 Privilege Escalation via UAC consent spawning Internet Explorer as SYSTEM

title: Windows CVE-2019-1388 Privilege Escalation via UAC consent spawning Internet Explorer as SYSTEM
id: b0eae416-5168-441e-8721-eff469f94377
status: stable
description: This rule looks for a process creation chain where the UAC consent process spawns Internet Explorer with evidence in the command line consistent with exploitation attempts. It flags executions where the spawned process runs with SYSTEM integrity, which indicates a high-impact privilege escalation. The detection relies on Windows process creation telemetry, including parent process name, child process name, command-line content, and integrity/user identifiers.
references:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388
  - https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-1388/proc_creation_win_exploit_cve_2019_1388.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-11-20
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2019-1388
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    ParentImage|endswith: \consent.exe
    Image|endswith: \iexplore.exe
    CommandLine|contains: " http"
  selection_rights:
    - IntegrityLevel:
        - System
        - S-1-16-16384
    - User|contains:
        - AUTHORI
        - AUTORI
  condition: all of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 02e0b2ea-a597-428e-b04a-af6a1a403e5c
    type: derived