CVE-2019-1579

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "httpd" or InitiatingProcessFileName =~ "php-fpm" // Beispiel für Webserver-Prozesse, die die Schwachstelle ausnutzen könnten
| where FileName in ("sh", "bash", "powershell.exe", "cmd.exe") // Typische Shell-Prozesse
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/C" // Indikator für Befehlsausführung
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, RemoteIP, RemotePort
| extend Threat = "CVE-2019-1579 Potential RCE via GlobalProtect"
| where DeviceName contains "GlobalProtect" or DeviceName contains "PaloAlto" // Anpassung an die Namenskonvention der GlobalProtect-Server

Splunk SPL

index=* (sourcetype=pan:globalprotect OR sourcetype=webserver) (process="sh" OR process="bash" OR process="powershell.exe" OR process="cmd.exe") (commandline="-c" OR commandline="/C")
| table _time, host, process, commandline, parent_process, dest_ip, dest_port
| rename host as DeviceName, process as FileName, commandline as ProcessCommandLine
| eval Threat = "CVE-2019-1579 Potential RCE via GlobalProtect"

Sigma

title: CVE-2019-1579 Palo Alto GlobalProtect RCE
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentImage|endswith:
      - '\httpd.exe'
      - '\php-fpm.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash.exe'
      - '\sh.exe'
    CommandLine|contains:
      - '-c'
      - '/C'
  condition: selection
  falsepositives:
    - Legitimate administrative activity
level: high
tags:
  - attack.execution
  - cve.2019.1579
  - cisa_kev

Elastic ES|QL

from process where
  (process.parent.executable.name == "httpd" or process.parent.executable.name == "php-fpm") and
  (process.executable.name == "sh" or process.executable.name == "bash" or process.executable.name == "powershell.exe" or process.executable.name == "cmd.exe") and
  (process.args contains "-c" or process.args contains "/C")
| project @timestamp, host.name, process.parent.executable.name, process.executable.name, process.command_line, process.working_directory, destination.ip, destination.port
| append {
    from panos.traffic where
      (source.ip is not null and destination.ip is not null) and
      (event.action == "allow" and threat.category == "vulnerability") and
      (threat.name == "CVE-2019-1579") // Annahme einer Threat-Prevention-Signatur
    | project @timestamp, host.name, source.ip, destination.ip, threat.name, threat.category
  }