CVE-2019-1130

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "AppXSVC.exe" or ProcessCommandLine contains "AppXSVC"
| where InitiatingProcessFileName !in ("svchost.exe", "services.exe") // Filter out legitimate service host processes if AppXSVC is a service
| where ProcessCommandLine contains "hardlink" or ProcessCommandLine contains "junction" or ProcessCommandLine contains "reparse"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (Image="*\\AppXSVC.exe" OR CommandLine="*AppXSVC*")
| NOT (ParentImage="*\\svchost.exe" OR ParentImage="*\\services.exe")
| (CommandLine="*hardlink*" OR CommandLine="*junction*" OR CommandLine="*reparse*")
| table _time, host, Image, CommandLine, ParentImage, ParentCommandLine

Sigma

title: Windows AppXSVC Hard Link EoP Attempt
status: experimental
description: Detects suspicious activity related to AppXSVC and hard link manipulation, indicative of CVE-2019-1130 exploitation.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1130
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\AppXSVC.exe'
        CommandLine|contains:
            - 'hardlink'
            - 'junction'
            - 'reparse'
    filter:
        ParentImage|endswith:
            - '\svchost.exe'
            - '\services.exe'
    condition: selection and not filter
fields:
    - CommandLine
    - ParentCommandLine
    - Image
    - ParentImage
level: high

Elastic ES|QL

from process where process.executable.full_path : "*\\AppXSVC.exe" or process.args : "*AppXSVC*"
| where not (process.parent.executable.full_path : "*\\svchost.exe" or process.parent.executable.full_path : "*\\services.exe")
| where process.args : "*hardlink*" or process.args : "*junction*" or process.args : "*reparse*"
| select @timestamp, host.name, process.executable.full_path, process.command_line, process.parent.executable.full_path, process.parent.command_line