Suspicious process executed with a high integrity level

Analytics BIOC Informational

Suspicious process executed with a high integrity level

A suspicious process was spawned with a High or System integrity level, which is higher than its parent process. This may indicate malicious privilege escalation.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Privilege Escalation (TA0004)

ATT&CK techniques: Abuse Elevation Control Mechanism (T1548)

Attacker's goals:

An attacker may attempt to gain higher privileges.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that is supposed to run with privileges.

Test period:: N/A (single event)
Deduplication:: 7 Days

1 variation:

Suspicious process executed with a high integrity level Low (parent: Informational)