CVE-2015-1701

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "notepad.exe" and FileName =~ "Taihou32.exe" or FileName =~ "Taihou64.exe" or FileName =~ "payload.exe"
| where InitiatingProcessIntegrityLevel == "Medium" and ProcessIntegrityLevel == "System"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessIntegrityLevel, ProcessIntegrityLevel, ReportId

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational) 
| (EventCode=4688 OR EventCode=1) 
| CommandLine IN ("*Taihou32.exe*", "*Taihou64.exe*", "*payload.exe*") 
| ParentProcessName="notepad.exe" 
| ProcessIntegrityLevel="System" 
| User NOT IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\LOCAL SERVICE", "NT AUTHORITY\\NETWORK SERVICE")

Sigma

title: Win32k LPE via ClientCopyImage
status: experimental
description: Detects potential exploitation of CVE-2015-1701 (MS15-051) via unusual process creation patterns.
references:
    - https://www.exploit-db.com/exploits/37049/
    - https://www.exploit-db.com/exploits/37367/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\notepad.exe'
        Image|endswith:
            - '\Taihou32.exe'
            - '\Taihou64.exe'
            - '\payload.exe'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
    - User
level: high

Elastic ES|QL

from process where event.type == "start" and 
  (process.parent.executable.full_path : "*\\notepad.exe" and 
   process.executable.full_path : ("*\\Taihou32.exe", "*\\Taihou64.exe", "*\\payload.exe")) 
| select @timestamp, host.name, process.parent.executable.full_path, process.executable.full_path, process.command_line, user.name