title: Hurricane Panda Activity
id: 0eb2107b-a596-422e-b123-b389d5594ed7
status: test
description: Detects Hurricane Panda Activity
author: Florian Roth
references:
  - https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
date: 2019/03/04
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
      - 'localgroup'
      - 'admin'
      - '/add'
    - CommandLine|contains:
      - '\Win64.exe'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.privilege_escalation
  - attack.g0009
  - attack.t1068
