SecBoard
Zurück zur CVE-Übersicht

CVE-2021-27076

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score27/100 — MITTEL
  • CVSS 8.8 — Hoch

EPSS-Score

15.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

Microsoft SharePoint Server Remote Code Execution Vulnerability

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Die Schwachstelle betrifft die Deserialisierung von nicht vertrauenswürdigen Daten in Microsoft SharePoint Server, insbesondere bei der Verarbeitung von InfoPath-Anhängen. Ein Angreifer kann durch Manipulation clientseitiger Daten Code im Kontext des SharePoint-Webserverprozesses ausführen. Die Detektion konzentriert sich auf ungewöhnliche Prozessausführungen oder Dateierstellungen durch den Share

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "OWSTIMER.EXE" // SharePoint worker processes
| where FileName in ("powershell.exe", "cmd.exe", "mshta.exe", "cscript.exe", "wscript.exe", "regsvr32.exe") // Common post-exploitation tools
  or FolderPath contains "\Windows\Temp\" and ProcessCommandLine contains ".exe" // Suspicious execution from temp directory
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational) 
(ParentProcessName="w3wp.exe" OR ParentProcessName="OWSTIMER.EXE") 
(ProcessName="powershell.exe" OR ProcessName="cmd.exe" OR ProcessName="mshta.exe" OR ProcessName="cscript.exe" OR ProcessName="wscript.exe" OR ProcessName="regsvr32.exe" OR (Image CONTAINS "\Windows\Temp\" AND CommandLine CONTAINS ".exe"))
| table _time, host, ParentProcessName, ProcessName, CommandLine, ParentCommandLine

Sigma

title: SharePoint RCE via Deserialization
status: experimental
description: Detects potential remote code execution attempts against Microsoft SharePoint Server exploiting deserialization vulnerabilities, indicated by unusual process spawning from SharePoint worker processes.
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-21-276/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\OWSTIMER.EXE'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\regsvr32.exe'
    filter_temp_exec:
        Image|contains: '\Windows\Temp\'
        CommandLine|endswith: '.exe'
    condition: selection or filter_temp_exec
level: high

Elastic ES|QL

from process where 
  (process.parent.name : ("w3wp.exe", "OWSTIMER.EXE")) and 
  (process.name : ("powershell.exe", "cmd.exe", "mshta.exe", "cscript.exe", "wscript.exe", "regsvr32.exe") or 
   (process.executable.path : "*\\Windows\\Temp\\*" and process.args : "*.exe"))
| select @timestamp, host.name, process.parent.name, process.name, process.command_line, process.parent.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:microsoft:business_productivity_servers:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

Referenzen