CVE-2016-3351

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("iexplore.exe", "microsoftedge.exe")
| where ProcessCommandLine contains "http" or ProcessCommandLine contains "https"
| where InitiatingProcessParentFileName != "explorer.exe" // Filter out normal user browsing
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemoteUrl
| summarize count() by bin(Timestamp, 1h), DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
| where count_ > 5 // Look for unusual high number of connections from browser process to external IPs

Splunk SPL

index=* (sourcetype=ms:defender OR sourcetype=ms:sysmon) (Image="*\\iexplore.exe" OR Image="*\\microsoftedge.exe")
| where not ParentImage="*\\explorer.exe"
| stats count by _time, host, Image, CommandLine, DestIP, URL
| where count > 5
| table _time, host, Image, CommandLine, DestIP, URL

Sigma

title: Microsoft Browser Information Disclosure Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\iexplore.exe'
      - '\microsoftedge.exe'
    ParentImage|endswith:
      - '\explorer.exe' # Exclude normal user browsing
  condition: selection
  timeframe: 1h
  level: medium
falsepositives:
  - Legitimate browser activity (if not filtered by parent process)

Elastic ES|QL

from process where process.executable in ("iexplore.exe", "microsoftedge.exe") and not process.parent.executable == "explorer.exe"
| stats count() by @timestamp, host.name, process.executable, process.command_line, destination.ip, url.full
| where count > 5
| sort @timestamp desc