CVE-2017-0144

Sentinel/Defender KQL

DeviceNetworkEvents
| where Protocol == "SMB" and RemotePort == 445
| where InitiatingProcessCommandLine contains "powershell" or InitiatingProcessCommandLine contains "cmd.exe" or InitiatingProcessCommandLine contains "wmic"
| where ActionType == "ConnectionAttempt" or ActionType == "FileShareAccessed"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
// Erweiterte Erkennung für SMBv1-spezifische Anomalien oder DOUBLEPULSAR-Indikatoren erfordert tiefergehende Protokollanalyse, die über Standard-EDR-Events hinausgeht.
// Überwachung von SMBv1-Nutzung generell: 
// DeviceNetworkEvents | where Protocol == "SMB" and RemotePort == 445 and AdditionalFields contains "SMBv1" // (falls SMB-Version in Logs verfügbar)

Splunk SPL

index=* (sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security OR sourcetype=ms:defender:atp)
| search (EventCode=5140 OR EventCode=5145 OR EventCode=4624 OR EventCode=4688) (smb OR "SMBv1")
| search (CommandLine=*powershell* OR CommandLine=*cmd.exe* OR CommandLine=*wmic*)
| table _time, host, user, CommandLine, dest_ip, dest_port, EventCode
// Für DOUBLEPULSAR-spezifische Erkennung wäre eine Netzwerkanalyse (z.B. Zeek/Suricata-Logs) auf SMB-Traffic mit ungewöhnlichen Transaktionen oder Shellcode-Mustern erforderlich.

Sigma

title: SMBv1 RCE Exploitation Attempt (CVE-2017-0144)
author: SecBoard Operations
date: 2023/10/27
modified: 2023/10/27
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Protocol: "SMB"
    DestinationPort: 445
    Image|endswith: 
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wmic.exe'
  condition: selection
fields:
  - ComputerName
  - Image
  - CommandLine
  - SourceIp
  - DestinationIp
  - DestinationPort
level: high
tags:
  - attack.initial_access
  - attack.execution
  - cve.2017.0144
  - cisa_kev

Elastic ES|QL

from network where 
  event.dataset == "zeek.smb" and 
  destination.port == 445 and 
  (process.command_line : "*powershell*" or process.command_line : "*cmd.exe*" or process.command_line : "*wmic*")
| select @timestamp, host.name, process.command_line, source.ip, destination.ip, destination.port
// Die Erkennung von SMBv1-Nutzung erfordert spezifische Felder in den Logs, die die SMB-Version angeben. 
// Für DOUBLEPULSAR-Payloads wäre eine tiefere Analyse des SMB-Protokoll-Traffics notwendig, z.B. über IDS/IPS-Signaturen.