CVE-2020-1054

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe" or InitiatingProcessFileName =~ "cmd.exe" or InitiatingProcessFileName =~ "powershell.exe"
| where FileName !in ("svchost.exe", "lsass.exe", "winlogon.exe", "csrss.exe") // Ausschluss bekannter Systemprozesse, die Kernel-Interaktionen haben könnten
| where ProcessCommandLine has_any ("kernel", "privilege", "escalation") or ProcessCommandLine has_any ("drawiconex") // Beispielhafte Keywords, die in einem Exploit-Payload vorkommen könnten
| where ProcessIntegrityLevel == "System" and InitiatingProcessIntegrityLevel != "System" // Prozess startet mit System-Integrität, aber Initiator nicht
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessIntegrityLevel, ReportId

Splunk SPL

index=windows_events EventCode=4688 (New_Process_Name!=("svchost.exe" AND "lsass.exe" AND "winlogon.exe" AND "csrss.exe")) (CommandLine=*kernel* OR CommandLine=*privilege* OR CommandLine=*escalation* OR CommandLine=*drawiconex*) | eval ParentProcessIntegrityLevel=case(ParentProcessName="explorer.exe" OR ParentProcessName="cmd.exe" OR ParentProcessName="powershell.exe", "User", 1=1, "Unknown") | where NewProcessIntegrityLevel="System" AND ParentProcessIntegrityLevel!="System" | table _time, Host, ParentProcessName, ParentProcessCommandLine, NewProcessName, CommandLine, NewProcessIntegrityLevel, ParentProcessIntegrityLevel

Sigma

title: Windows Kernel-Mode Driver Privilege Escalation Attempt
status: experimental
description: Detects suspicious process creation patterns indicative of CVE-2020-1054 exploitation, where a user-level process attempts to elevate privileges to kernel mode.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-1054
    - http://packetstormsecurity.com/files/160515/Microsoft-Windows-DrawIconEx-Local-Privilege-Escalation.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\powershell.exe'
        Image|endswith:
            - '\svchost.exe'
            - '\lsass.exe'
            - '\winlogon.exe'
            - '\csrss.exe'
        CommandLine|contains:
            - 'kernel'
            - 'privilege'
            - 'escalation'
            - 'drawiconex'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
    - Image
    - ParentImage
level: high

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable == "explorer.exe" or process.parent.executable == "cmd.exe" or process.parent.executable == "powershell.exe") and not (process.executable == "svchost.exe" or process.executable == "lsass.exe" or process.executable == "winlogon.exe" or process.executable == "csrss.exe") and (process.args : "*kernel*" or process.args : "*privilege*" or process.args : "*escalation*" or process.args : "*drawiconex*") and process.integrity_level == "System" and process.parent.integrity_level != "System"