Elasticsearch-Based Threat Hunting to Detect Privilege Escalation Using Registry Modification and Process Injection Attacks

Akashdeep Bhardwaj (), Luxmi Sapra and Shawon Rahman ()
Additional contact information
Akashdeep Bhardwaj: Centre for Cybersecurity, School of Computer Science, University of Petroleum and Energy Studies, Dehradun 248007, India
Luxmi Sapra: Faculty Computer Application, Graphic Era Hill University, Dehradun 248002, India
Shawon Rahman: Department of Computer Science, University of Hawaii-Hilo, Hilo, HI 96720, USA

Future Internet, 2025, vol. 17, issue 9, 1-27

Abstract: Malicious actors often exploit persistence mechanisms, such as unauthorized modifications to Windows startup directories or registry keys, to achieve privilege escalation and maintain access on compromised systems. While information technology (IT) teams legitimately use these AutoStart Extension Points (ASEPs), adversaries frequently deploy malicious binaries with non-standard naming conventions or execute files from transient directories (e.g., Temp or Public folders). This study proposes a threat-hunting framework using a custom Elasticsearch Security Information and Event Management (SIEM) system to detect such persistence tactics. Two hypothesis-driven investigations were conducted: the first focused on identifying unauthorized ASEP registry key modifications during user logon events, while the second targeted malicious Dynamic Link Library (DLL) injections within temporary directories. By correlating Sysmon event logs (e.g., registry key creation/modification and process creation events), the researchers identified attack chains involving sequential registry edits and malicious file executions. Analysis confirmed that Sysmon Event ID 12 (registry object creation) and Event ID 7 (DLL loading) provided critical forensic evidence for detecting these tactics. The findings underscore the efficacy of real-time event correlation in SIEM systems in disrupting adversarial workflows, enabling rapid mitigation through the removal of malicious entries. This approach advances proactive defense strategies against privilege escalation and persistence, emphasizing the need for granular monitoring of registry and filesystem activities in enterprise environments.

Keywords: privilege escalation; persistence; windows registry; startup directory; AutoStart Extension Point (ASEP); Sysmon; event correlation; SIEM; elasticsearch; threat hunting; malicious DLL; boot logon autorun; registry key modification; forensic analysis; attack detection (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/17/9/394/pdf (application/pdf)
https://www.mdpi.com/1999-5903/17/9/394/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:17:y:2025:i:9:p:394-:d:1737549

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().