CVE-2019-19462

Sentinel/Defender KQL

DeviceEvents
| where ActionType == "KernelPanic" or ActionType == "Crash"
| where InitiatingProcessFileName contains "relay_open" or InitiatingProcessFileName contains "relay_close_buf"
| project Timestamp, DeviceName, InitiatingProcessFileName, ReportId, AdditionalFields

Splunk SPL

index=linux (sourcetype=syslog OR sourcetype=kern.log) (relay_open OR relay_close_buf) (panic OR crash OR "general protection fault")
| table _time, host, sourcetype, _raw

Sigma

title: Linux Kernel Relay DoS/PrivEsc
status: experimental
description: Detects attempts to exploit CVE-2019-19462 in the Linux kernel's relay subsystem.
logsource:
  product: linux
  service: kernel
detection:
  selection:
    keywords:
      - 'relay_open'
      - 'relay_close_buf'
      - 'general protection fault'
      - 'BUG: Unable to handle kernel data access'
      - 'kernel panic'
      - 'crash'
  condition: selection
level: high

Elastic ES|QL

from logs-system.*
| where message : ("relay_open" or "relay_close_buf") and message : ("general protection fault" or "BUG: Unable to handle kernel data access" or "kernel panic" or "crash")
| select @timestamp, host.name, message