Windows Process Access: PROCESS_ALL_ACCESS Granted to Uncommon Target Image

title: "Windows Process Access: PROCESS_ALL_ACCESS Granted to Uncommon Target Image"
id: 022b4db6-1993-46c8-a38e-daf1aec436ce
status: test
description: This rule flags process access requests where the target executable path ends with a set of uncommon Windows tools and the granted access mask equals 0x1FFFFF (PROCESS_ALL_ACCESS). Attackers may request full access to a process to manipulate, inspect, or stage further actions, making these events high-signal for potential privilege escalation or stealthy tampering. It relies on Windows process access telemetry that records the target image path and the granted access mask.
references:
  - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-27
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.011
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith:
      - \calc.exe
      - \calculator.exe
      - \mspaint.exe
      - \notepad.exe
      - \ping.exe
      - \wordpad.exe
      - \write.exe
    GrantedAccess: "0x1FFFFF"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: a24e5861-c6ca-4fde-a93c-ba9256feddf0
    type: derived