CVE-2021-38647

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where NewProcessName contains "cmd.exe" or NewProcessName contains "powershell.exe" or NewProcessName contains "sh" or NewProcessName contains "bash"
| where ParentProcessName contains "omiagent" or ParentProcessName contains "omiserver"
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=linux_audit)
| (EventCode=4688 OR type=SYSCALL)
| (NewProcessName="*cmd.exe*" OR NewProcessName="*powershell.exe*" OR NewProcessName="*sh*" OR NewProcessName="*bash*")
| (ParentProcessName="*omiagent*" OR ParentProcessName="*omiserver*")
| table _time, host, user, ParentProcessName, NewProcessName, CommandLine

Sigma

title: OMI RCE Suspicious Process Creation
status: experimental
description: Detects suspicious process creation by OMI processes, indicative of CVE-2021-38647 exploitation.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|contains: ['omiagent', 'omiserver']
    NewProcessName|contains: ['cmd.exe', 'powershell.exe', 'sh', 'bash']
  condition: selection
level: critical

Elastic ES|QL

from logs-windows.security-*
| where event.code == 4688
| where process.parent.name : ("omiagent", "omiserver")
| where process.name : ("cmd.exe", "powershell.exe", "sh", "bash")
| select @timestamp, host.name, user.name, process.parent.name, process.name, process.command_line