Analytics BIOC Low
✕

LOLBIN process executed with a high integrity level

A process spawned a suspicious LOLBIN process with a higher/system integrity level. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism (T1548)
Attacker's goals:

An attacker may attempt to gain higher privileges.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that is supposed to run with privileges.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • LOLBIN process executed with a high integrity level by a web server process or CGO Medium (parent: Low) Adds External Remote Services (T1133) Server Software Component: Web Shell (T1505.003)