CVE-2019-1385

Sentinel/Defender KQL

DeviceFileEvents
| where ActionType == "HardlinkCreated" or ActionType == "FileCreated"
| where InitiatingProcessCommandLine contains "AppXDeploymentServer.exe" or InitiatingProcessFileName =~ "AppXDeploymentServer.exe"
| where FileName has_any ("system32", "windows", "program files") // Adjust paths to critical system files
| where InitiatingProcessIntegrityLevel == "Low" or InitiatingProcessIntegrityLevel == "Medium"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName, FileName, FolderPath, InitiatingProcessIntegrityLevel, ActionType

Splunk SPL

index=windows (EventCode=1 OR EventCode=11) (Image="*AppXDeploymentServer.exe" OR ParentImage="*AppXDeploymentServer.exe") (TargetFilename="*system32*" OR TargetFilename="*windows*" OR TargetFilename="*program files*")
| where (IntegrityLevel="Low" OR IntegrityLevel="Medium")
| table _time, Hostname, Image, ParentImage, TargetFilename, IntegrityLevel, EventCode

Sigma

title: Windows AppX Hard Link DoS
author: SecBoard
description: Detects potential exploitation of CVE-2019-1385 involving hard link creation by the AppX Deployment service to overwrite system files.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\AppXDeploymentServer.exe'
    CommandLine|contains: 'hardlink'
    TargetFilename|contains:
      - '\Windows\System32\'
      - '\Windows\'
      - '\Program Files\'
  condition: selection
fields:
  - Image
  - CommandLine
  - TargetFilename
  - User
level: high

Elastic ES|QL

from logs-windows.*
| where event.category == "process"
| where process.executable : "*AppXDeploymentServer.exe"
| where process.command_line : "*hardlink*"
| where file.path : ("*\\Windows\\System32\\*", "*\\Windows\\*", "*\\Program Files\\*")
| select @timestamp, host.name, process.executable, process.command_line, file.path, user.name