CVE-2019-1405

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where NewProcessName contains "svchost.exe" and CommandLine contains "-k LocalServiceNetworkRestricted" // UPnP service often runs under svchost
| where ParentProcessName contains "svchost.exe" // Look for unusual parent processes or process chains
| where CommandLine contains "/c" or CommandLine contains "powershell" or CommandLine contains "cmd.exe" // Indicators of shell execution
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine, ProcessId, ParentProcessId
| join kind=leftouter (
    SecurityEvent
    | where EventID == 4697 // A service was installed in the system
    | where ServiceName contains "upnphost" or ServiceName contains "ssdpsrv"
    | project TimeGenerated, Computer, ServiceName, ServiceFileName
) on Computer
| where isnotempty(ServiceName) // Correlate with UPnP service activity
| extend Anomaly = iff(CommandLine contains "/c" or CommandLine contains "powershell" or CommandLine contains "cmd.exe", "Potential UPnP EoP", "")
| where Anomaly != ""

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 New_Process_Name="*svchost.exe" CommandLine="*-k LocalServiceNetworkRestricted*" (CommandLine="*/c*" OR CommandLine="*powershell*" OR CommandLine="*cmd.exe*")
| join type=left EventCode=4697 Service_Name="*upnphost*" OR Service_Name="*ssdpsrv*"
| eval Anomaly = if(match(CommandLine, "/c|powershell|cmd.exe"), "Potential UPnP EoP", "")
| where Anomaly!=""
| table _time, host, Account_Name, Parent_Process_Name, New_Process_Name, Command_Line, Process_ID, Parent_Process_ID, Service_Name, Anomaly

Sigma

title: Windows UPnP Service EoP via COM Object Creation
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential exploitation of CVE-2019-1405 where the Windows UPnP service improperly allows COM object creation leading to privilege escalation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1405
  - http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html
author: SecBoard Operations
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    EventID: 4688
    NewProcessName|endswith:
      - '\svchost.exe'
    CommandLine|contains:
      - '-k LocalServiceNetworkRestricted'
  selection_shell:
    CommandLine|contains:
      - '/c'
      - 'powershell'
      - 'cmd.exe'
  condition: selection_process and selection_shell
  falsepositives:
    - Legitimate system administration activities (requires careful tuning)
level: high

Elastic ES|QL

from security_events
| where event.code == 4688 and process.executable.endswith('svchost.exe') and process.command_line.includes('-k LocalServiceNetworkRestricted')
| where process.command_line.includes('/c') or process.command_line.includes('powershell') or process.command_line.includes('cmd.exe')
| project @timestamp, host.name, user.name, process.parent.executable, process.executable, process.command_line, process.pid, process.parent.pid
| join kind=left outer (
    from security_events
    | where event.code == 4697 and (service.name.includes('upnphost') or service.name.includes('ssdpsrv'))
    | project @timestamp, host.name, service.name, service.file.path
) on host.name
| where not is_null(service.name)
| append
| eval Anomaly = if(process.command_line.includes('/c') or process.command_line.includes('powershell') or process.command_line.includes('cmd.exe'), 'Potential UPnP EoP', '')
| where Anomaly != ''