CVE-2020-0618

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where NewProcessName contains "cmd.exe" or NewProcessName contains "powershell.exe" or NewProcessName contains "mshta.exe" // Potentially malicious processes
| where ParentProcessName contains "ReportingServicesService.exe" // Parent process is SSRS
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (New_Process_Name=*cmd.exe* OR New_Process_Name=*powershell.exe* OR New_Process_Name=*mshta.exe*) Parent_Process_Name=*ReportingServicesService.exe* | table _time, host, Account_Name, Parent_Process_Name, New_Process_Name, CommandLine

Sigma

title: SSRS RCE via Deserialization
status: experimental
description: Detects potential remote code execution via CVE-2020-0618 in Microsoft SQL Server Reporting Services by monitoring for suspicious child processes spawned by the SSRS service.
author: SecBoard
date: 2024/07/30
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    ParentProcessName|endswith: 'ReportingServicesService.exe'
    NewProcessName|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'mshta.exe'
  condition: selection
fields:
  - ComputerName
  - User
  - ParentProcessName
  - NewProcessName
  - CommandLine
tags:
  - attack.execution
  - cve.2020.0618

Elastic ES|QL

FROM winlog.eventdata
WHERE event.code == 4688
AND process.parent.executable.keyword : "*ReportingServicesService.exe"
AND process.executable.keyword : ("*cmd.exe", "*powershell.exe", "*mshta.exe")
SELECT @timestamp, host.name, user.name, process.parent.executable, process.executable, process.command_line