CVE-2021-36934

Sentinel/Defender KQL

DeviceFileEvents
| where FolderPath contains "\\Windows\\system32\\config" and FileName == "sam"
| where InitiatingProcessCommandLine contains "icacls" and InitiatingProcessCommandLine contains "BUILTIN\\Users:(I)(RX)"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath
// Ergänzend: Überprüfung auf VSS-Schattenkopien (falls Logs verfügbar)
// DeviceProcessEvents
// | where FileName == "vssadmin.exe" and ProcessCommandLine contains "list shadows"
// | where ReportId contains "Original Volume: (C:)"

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=WinEventLog:Security) EventCode=1 OR EventCode=4663
| search (TargetFilename="*\\Windows\\system32\\config\\sam" AND Access_Mask="0x120089" AND User="BUILTIN\\Users")
| table _time, host, Image, CommandLine, TargetFilename, Access_Mask, User
// Ergänzend: Überprüfung auf VSS-Schattenkopien (falls Logs verfügbar)
// index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
// | search CommandLine="*vssadmin list shadows*"
// | search Output="*Original Volume: (C:)*"

Sigma

title: CVE-2021-36934 HiveNightmare/SeriousSAM Detection
status: experimental
description: Detects attempts to check for or exploit CVE-2021-36934 (HiveNightmare/SeriousSAM) by checking ACLs on SAM file or listing VSS shadow copies.
references:
    - https://www.kb.cert.org/vuls/id/506989
    - http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
logsource:
    category: process_creation
    product: windows
detection:
    selection_icacls:
        Image|endswith:
            - '\icacls.exe'
        CommandLine|contains:
            - '%windir%\system32\config\sam'
            - 'BUILTIN\Users:(I)(RX)'
    selection_vssadmin:
        Image|endswith:
            - '\vssadmin.exe'
        CommandLine|contains:
            - 'list shadows'
    condition: selection_icacls or selection_vssadmin
falsepositives:
    - Legitimate administrative actions (e.g., security audits, troubleshooting)
level: high

Elastic ES|QL

from process where process.executable : ("*\\icacls.exe", "*\\vssadmin.exe") and (process.args : ("%windir%\\system32\\config\\sam", "BUILTIN\\Users:(I)(RX)") or process.args : "list shadows")
// Ergänzend: Überprüfung auf VSS-Schattenkopien (falls Output verfügbar)
// from process where process.executable : "*\\vssadmin.exe" and process.args : "list shadows" and process.output : "*Original Volume: (C:)*"