rule added: Windows Kernel and 3rd-party drivers exploits. Token stealing

rules/windows/sysmon/sysmon_kernel_and_3rd_party_drivers_exploits_token_stealing.yml

@@ -0,0 +1,25 @@
+title: Windows Kernel and 3rd-party drivers exploits. Token stealing
+description: Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level
+references:
+    - https://www.slideshare.net/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
+tags:
+    - attack.privilege_escalation
+    - attack.t1068
+status: experimental
+author: Teymur Kheirkhabarov (source), Daniil Yugoslavskiy (rule)
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection:
+        EventID: 1
+        ParentIntegrityLevel: Medium
+        IntegrityLevel: System
+        User: "NT AUTHORITY\\SYSTEM"
+    condition: selection
+falsepositives:
+    - Unknown
+level: critical
+enrichment:
+    - EN_0001_cache_sysmon_event_id_1_info                # http://bit.ly/314zc6x
+    - EN_0002_enrich_sysmon_event_id_1_with_parent_info   # http://bit.ly/2KmSC0l