host-interaction/process/modify
rule:
meta:
name: acquire debug privileges
namespace: host-interaction/process/modify
authors:
- william.ballenthin@mandiant.com
scopes:
static: basic block
dynamic: call
att&ck:
- Privilege Escalation::Access Token Manipulation [T1134]
examples:
- Practical Malware Analysis Lab 01-04.exe_:0x401174
features:
- or:
- and:
- string: "SeDebugPrivilege"
- optional:
- match: modify access privileges
- and:
- api: RtlAdjustPrivilege
- number: 20 = SE_DEBUG_PRIVILEGE
last edited: 2025-08-12 16:21:05