CVE-2021-33771

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where ParentProcessName has_any ("explorer.exe", "cmd.exe", "powershell.exe")
| where ProcessName in~ ("cmd.exe", "powershell.exe", "wmic.exe", "sc.exe", "net.exe")
| where CommandLine has_any ("/c", "-c", "-command", "create", "start")
| where SubjectUserSid != "S-1-5-18" // Not SYSTEM account
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, ProcessName, CommandLine, ProcessId, ParentProcessId

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where ParentProcessName IN ("explorer.exe", "cmd.exe", "powershell.exe")
| where ProcessName IN ("cmd.exe", "powershell.exe", "wmic.exe", "sc.exe", "net.exe")
| where CommandLine LIKE "* /c *" OR CommandLine LIKE "* -c *" OR CommandLine LIKE "* -command *" OR CommandLine LIKE "* create *" OR CommandLine LIKE "* start *"
| where NOT SubjectUserSid="S-1-5-18"
| table _time, ComputerName, SubjectUserName, ParentProcessName, ProcessName, CommandLine, ProcessId, ParentProcessId

Sigma

title: Windows Kernel EoP Behavioral Detection
status: experimental
description: Detects unusual process creation patterns indicative of privilege escalation attempts related to Windows Kernel vulnerabilities.
author: SecBoard Operations
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|endswith:
      - 'explorer.exe'
      - 'cmd.exe'
      - 'powershell.exe'
    Image|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'wmic.exe'
      - 'sc.exe'
      - 'net.exe'
    CommandLine|contains:
      - '/c'
      - '-c'
      - '-command'
      - 'create'
      - 'start'
  filter:
    UserSID: 'S-1-5-18'
  condition: selection and not filter
level: high

Elastic ES|QL

from logs-windows.security-*
| where event.code == 4688
| where process.parent.name in ('explorer.exe', 'cmd.exe', 'powershell.exe')
| where process.name in ('cmd.exe', 'powershell.exe', 'wmic.exe', 'sc.exe', 'net.exe')
| where process.command_line matches any ('* /c *', '* -c *', '* -command *', '* create *', '* start *')
| where user.sid != 'S-1-5-18'
| project @timestamp, host.name, user.name, process.parent.name, process.name, process.command_line, process.pid, process.parent.pid