Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

title: "Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution"
id: ec6a081f-cd61-4090-9474-4a05bbefcacb
status: test
description: This rule flags process creation events where the executable path ends with Crassus.exe, the original file name is Crassus.exe, or the process description contains the string "Crassus". Crassus is used to discover Windows privilege escalation opportunities, which can precede further exploitation. The detection relies on process creation telemetry that includes image path, OriginalFileName, and Description metadata from Windows.
references:
  - https://github.com/vu-ls/Crassus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_crassus.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2023-04-17
tags:
  - attack.discovery
  - attack.reconnaissance
  - attack.t1590.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Crassus.exe
    - OriginalFileName: Crassus.exe
    - Description|contains: Crassus
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2c32b543-1058-4808-91c6-5b31b8bed6c5
    type: derived