CVE-1999-1579

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessFileName =~ "xenroll.dll"
| where ActionType == "FileCreated"
| summarize FileCount = count() by DeviceId, InitiatingProcessCommandLine
| where FileCount > 50 // Threshold for unusual activity, adjust as needed
| project DeviceId, InitiatingProcessCommandLine, FileCount, bin(Timestamp, 1h)

Splunk SPL

index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11 Image="*xenroll.dll" TargetFilename!=NULL
| stats count as FileCount by Host, Image, CommandLine
| where FileCount > 50 // Threshold for unusual activity, adjust as needed
| table Host, Image, CommandLine, FileCount

Sigma

title: Cenroll ActiveX File Creation DoS
id: 7a2011d0-8f06-00c0-4fc2-95e100000000
status: experimental
description: Detects potential denial of service via Cenroll ActiveX control creating numerous files.
author: SecBoard
date: 2023/10/27
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: '\xenroll.dll'
    EventType: 'CreateFile'
  condition: selection | stats count() by Image, CommandLine | where count() > 50
falsepositives:
  - Legitimate application behavior (unlikely for high volume)
level: medium

Elastic ES|QL

file where process.executable : "*xenroll.dll" and event.action : "file_create"
| stats count() as file_count by host.name, process.command_line
| where file_count > 50
| select host.name, process.command_line, file_count