CVE-2018-8174

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "wscript.exe" or FileName =~ "cscript.exe" or FileName =~ "mshta.exe" or FileName =~ "iexplore.exe"
| where ProcessCommandLine contains "Class_Terminate" or ProcessCommandLine contains "Erase" and ProcessCommandLine contains "Dim ArrA" // Beispiel für PoC-Muster
| where InitiatingProcessFileName !in ("explorer.exe", "cmd.exe", "powershell.exe") // Filtert typische interaktive Ausführungen
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Splunk SPL

index=windows (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventID=1) OR (sourcetype=WinEventLog:Security EventID=4688)
| where (NewProcessName="wscript.exe" OR NewProcessName="cscript.exe" OR NewProcessName="mshta.exe" OR NewProcessName="iexplore.exe")
| where CommandLine LIKE "%Class_Terminate%" OR CommandLine LIKE "%Erase%" AND CommandLine LIKE "%Dim ArrA%"
| where ParentProcessName!="explorer.exe" AND ParentProcessName!="cmd.exe" AND ParentProcessName!="powershell.exe"
| table _time, Host, NewProcessName, CommandLine, ParentProcessName, ParentCommandLine

Sigma

title: VBScript Engine RCE CVE-2018-8174 Behavioral Detection
status: experimental
description: Detects potential exploitation attempts of CVE-2018-8174 by monitoring VBScript engine processes for suspicious command-line arguments related to object manipulation and termination.
references:
    - https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\iexplore.exe'
        CommandLine|contains:
            - 'Class_Terminate'
            - 'Erase'
            - 'Dim ArrA'
    condition: selection
fields:
    - Image
    - CommandLine
    - ParentImage
    - ParentCommandLine
tags:
    - attack.execution
    - attack.t1059.005
    - cve.2018-8174
    - exploit.rce

Elastic ES|QL

from process where
  (process.executable.name : ("wscript.exe", "cscript.exe", "mshta.exe", "iexplore.exe")) and
  (process.args : ("*Class_Terminate*", "*Erase*", "*Dim ArrA*")) and
  not (process.parent.executable.name : ("explorer.exe", "cmd.exe", "powershell.exe"))
| select @timestamp, host.name, process.executable.name, process.command_line, process.parent.executable.name, process.parent.command_line