CVE-2021-36955

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "cmd.exe" or FileName =~ "powershell.exe" or FileName =~ "wmic.exe"
| where InitiatingProcessFileName =~ "lsass.exe" or InitiatingProcessFileName =~ "services.exe" or InitiatingProcessFileName =~ "winlogon.exe" // Beispiel für ungewöhnliche Initiatoren
| where ProcessCommandLine has_any ("net user", "taskkill", "sc create", "schtasks") // Beispiel für potenziell bösartige Befehle nach Privilege Escalation
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (EventCode=4688 OR EventCode=1) (New_Process_Name="*cmd.exe" OR New_Process_Name="*powershell.exe" OR New_Process_Name="*wmic.exe")
| (Parent_Process_Name="*lsass.exe" OR Parent_Process_Name="*services.exe" OR Parent_Process_Name="*winlogon.exe")
| (CommandLine="*net user*" OR CommandLine="*taskkill*" OR CommandLine="*sc create*" OR CommandLine="*schtasks*")
| table _time, Host, Parent_Process_Name, New_Process_Name, CommandLine

Sigma

title: Windows CLFS Privilege Escalation Behavioral Detection
status: experimental
description: Detects suspicious process creation patterns indicative of privilege escalation via CLFS driver vulnerability.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36955
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wmic.exe'
    parent_process_selection:
        ParentImage|endswith:
            - '\lsass.exe'
            - '\services.exe'
            - '\winlogon.exe'
    command_line_keywords:
        CommandLine|contains:
            - 'net user'
            - 'taskkill'
            - 'sc create'
            - 'schtasks'
    condition: selection and parent_process_selection and command_line_keywords
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start"
| where process.executable.name in ("cmd.exe", "powershell.exe", "wmic.exe")
| where process.parent.executable.name in ("lsass.exe", "services.exe", "winlogon.exe")
| where process.args contains any ("net user", "taskkill", "sc create", "schtasks")
| select @timestamp, host.name, process.parent.executable.name, process.executable.name, process.command_line