CVE-2021-38645

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where NewProcessName contains "omi" or CommandLine contains "omi"
| where ParentProcessName contains "Azure" or ParentProcessName contains "Management"
| where not (NewProcessName has_any ("omiserver", "omiprovider")) // Exclude known legitimate OMI processes if they are not the direct cause
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (New_Process_Name=*omi* OR CommandLine=*omi*)
| where Parent_Process_Name=*Azure* OR Parent_Process_Name=*Management*
| where NOT (New_Process_Name IN ("omiserver", "omiprovider"))
| table _time, host, Account_Name, New_Process_Name, CommandLine, Parent_Process_Name

Sigma

title: OMI Privilege Escalation Attempt
status: experimental
description: Detects suspicious process creation related to Open Management Infrastructure (OMI) that could indicate privilege escalation, especially from Azure VM Management Extensions.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|contains: # Adjust based on specific Azure VM Management Extension process names
      - 'Azure'
      - 'Management'
    CommandLine|contains:
      - 'omi'
    NewProcessName|contains:
      - 'omi'
  filter:
    NewProcessName|endswith:
      - 'omiserver.exe'
      - 'omiprovider.exe'
  condition: selection and not filter
level: high

Elastic ES|QL

from winlog.eventdata
| where event.code == 4688
| where process.executable.text_value like '%omi%' or process.command_line.text_value like '%omi%'
| where process.parent.executable.text_value like '%Azure%' or process.parent.executable.text_value like '%Management%'
| where not (process.executable.text_value in ('omiserver.exe', 'omiprovider.exe'))
| select @timestamp, host.name, user.name, process.executable, process.command_line, process.parent.executable