Windows mklink Symlink from osk.exe to cmd.exe for Login Screen Privilege Escalation

title: Windows mklink Symlink from osk.exe to cmd.exe for Login Screen Privilege Escalation
id: d64f1887-82cb-4c0d-b5cb-9da5ee1ba485
status: test
description: This rule flags process creation where mklink is used to create a symbolic link involving osk.exe and cmd.exe, with cmd.exe targeting identified by cmd.exe image/original file name. The technique can enable execution of an elevated command prompt from the Windows login screen without requiring an interactive login. Telemetry relies on Windows process creation events, including the process image and command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1546.008/T1546.008.md
  - https://ss64.com/nt/mklink.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
author: frack113, Huntrule Team
date: 2022-12-11
modified: 2022-12-20
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.008
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains|all:
      - mklink
      - \osk.exe
      - \cmd.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd/info.yml
license: DRL-1.1
related:
  - id: e9b61244-893f-427c-b287-3e708f321c6b
    type: derived