CVE-2021-38648

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where NewProcessName contains "cmd.exe" or NewProcessName contains "powershell.exe" or NewProcessName contains "sh.exe"
| where ParentProcessName contains "omiagent" or ParentProcessName contains "omiserver"
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (New_Process_Name=*cmd.exe* OR New_Process_Name=*powershell.exe* OR New_Process_Name=*sh.exe*) (Parent_Process_Name=*omiagent* OR Parent_Process_Name=*omiserver*)
| table _time, host, Account_Name, Parent_Process_Name, New_Process_Name, CommandLine

Sigma

title: OMI Privilege Escalation - Suspicious Process Creation
status: experimental
description: Detects suspicious process creation (e.g., shell) by OMI processes, indicating potential privilege escalation via CVE-2021-38648.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\omiagent.exe'
      - '\omiserver.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
  condition: selection
level: high

Elastic ES|QL

from logs-windows.security-*
| where event.code == 4688
| where process.parent.executable.keyword : ("*omiagent.exe", "*omiserver.exe")
| where process.executable.keyword : ("*cmd.exe", "*powershell.exe", "*sh.exe")
| select @timestamp, host.name, user.name, process.parent.executable, process.executable, process.command_line