CVE-2017-0145

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "smb" and FileName in ("powershell.exe", "cmd.exe", "wmic.exe")
| where ProcessCommandLine contains "DOUBLEPULSAR" or ProcessCommandLine contains "EternalBlue"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath, SHA256
| join kind=leftouter (
    DeviceNetworkEvents
    | where RemotePort == 445 and InitiatingProcessCommandLine contains "smb"
    | summarize count() by DeviceName, RemoteIP
) on DeviceName
| extend Detection = "Potential SMBv1 RCE (CVE-2017-0145) via DOUBLEPULSAR/EternalBlue related activity"

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (EventCode=4688 OR EventCode=1) ProcessCommandLine=*smb* (Process="powershell.exe" OR Process="cmd.exe" OR Process="wmic.exe")
| search ProcessCommandLine=*DOUBLEPULSAR* OR ProcessCommandLine=*EternalBlue*
| table _time, host, Process, ProcessCommandLine, ParentProcessName, ParentProcessCommandLine, Image, Hashes
| join type=left (
    index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3 DestPort=445
    | stats count by host, DestIp
) using host
| eval Detection = "Potential SMBv1 RCE (CVE-2017-0145) via DOUBLEPULSAR/EternalBlue related activity"

Sigma

title: SMBv1 RCE CVE-2017-0145 Detection
author: SecBoard
description: Detects potential exploitation of CVE-2017-0145 (SMBv1 RCE) by looking for suspicious process creation or network activity related to SMBv1 and known exploit tools like DOUBLEPULSAR or EternalBlue.
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    ParentImage|endswith: '\smb.sys'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'DOUBLEPULSAR'
      - 'EternalBlue'
  selection_network:
    EventID: 3 # Sysmon Network Connection
    DestinationPort: 445
    Initiated: 'true'
    Image|contains:
      - 'smb'
  condition: selection_process or selection_network
fields:
  - Image
  - CommandLine
  - ParentImage
  - DestinationIp
  - DestinationPort
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and 
  (process.parent.executable.full_path : "*\\smb.sys" or process.parent.name : "smb.sys") and 
  (process.executable.name : ("powershell.exe", "cmd.exe", "wmic.exe")) and 
  (process.args : ("*DOUBLEPULSAR*", "*EternalBlue*"))
| append (
  from network where event.category == "network" and destination.port == 445 and 
  (process.executable.name : "*smb*" or process.name : "smb.sys")
)
| project @timestamp, host.name, process.executable.name, process.command_line, process.parent.executable.name, destination.ip, destination.port
| set detection.note = "Potential SMBv1 RCE (CVE-2017-0145) via DOUBLEPULSAR/EternalBlue related activity"