CVE-2015-2546

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd.exe"
| where InitiatingProcessIntegrityLevel == "Low" or InitiatingProcessIntegrityLevel == "Medium"
| where FileName has_any ("win32k.sys", "ntoskrnl.exe") // Indikator für Kernel-Interaktion, muss verfeinert werden
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, FolderPath

Splunk SPL

index=windows_events (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| search (EventCode=4688 OR EventCode=1 OR EventCode=7) (CommandLine=*powershell* OR CommandLine=*cmd.exe*)
| search (ParentProcessIntegrityLevel="Low" OR ParentProcessIntegrityLevel="Medium")
| search (Image="*win32k.sys" OR Image="*ntoskrnl.exe")
| table _time, host, EventCode, ProcessName, CommandLine, ParentProcessName, ParentProcessIntegrityLevel

Sigma

title: Win32k EoP Attempt
status: experimental
description: Detects potential exploitation attempts of Win32k memory corruption vulnerabilities leading to privilege escalation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2015-2546
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentProcessIntegrityLevel|endswith: ['Low', 'Medium']
        Image|endswith: ['\cmd.exe', '\powershell.exe']
        CommandLine|contains: ['win32k.sys', 'ntoskrnl.exe'] # Placeholder, needs refinement based on actual exploit behavior
    condition: selection
level: high

Elastic ES|QL

from logs-windows.*
| where event.category == "process"
| where process.parent.integrity_level in ("low", "medium")
| where process.executable in ("cmd.exe", "powershell.exe")
| where process.command_line : ("*win32k.sys*", "*ntoskrnl.exe*") // Placeholder, needs refinement
| select @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, process.parent.integrity_level