CVE-2018-8453

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "win32k.sys" and InitiatingProcessIntegrityLevel != "System" and InitiatingProcessIntegrityLevel != "High"
| where ActionType == "ProcessCreated" or ActionType == "ProcessTampering"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, ProcessCommandLine, ProcessId, ParentProcessId, InitiatingProcessParentFileName

Splunk SPL

index=your_windows_index sourcetype=your_process_events_sourcetype (CommandLine="*win32k.sys*" OR ParentCommandLine="*win32k.sys*") NOT (IntegrityLevel="System" OR IntegrityLevel="High")
| table _time, host, Image, CommandLine, ParentImage, ParentCommandLine, IntegrityLevel

Sigma

title: Win32k EoP Attempt (CVE-2018-8453 Behavioral)
status: experimental
description: Detects suspicious process creation or tampering potentially related to Win32k Elevation of Privilege vulnerability CVE-2018-8453.
references:
  - https://securelist.com/cve-2018-8453-used-in-targeted-attack
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 'win32k.sys'
  filter:
    IntegrityLevel: ['System', 'High']
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
  - IntegrityLevel
level: high

Elastic ES|QL

from logs-windows.events.process_creation-*
| where process.command_line : "*win32k.sys*"
| where not process.integrity_level in ("System", "High")
| select @timestamp, host.name, process.executable, process.command_line, process.parent.executable, process.parent.command_line, process.integrity_level