CVE-2021-43226

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "CLFS" or InitiatingProcessCommandLine contains "CLFS" // Placeholder, refine based on specific CLFS driver interaction patterns
| where ActionType == "ProcessCreated" or ActionType == "FileCreated" or ActionType == "RegistryValueSet"
| where InitiatingProcessIntegrityLevel != "System" and ProcessIntegrityLevel == "System" // Look for privilege escalation
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath, RegistryKey, RegistryValueData, InitiatingProcessIntegrityLevel, ProcessIntegrityLevel, ReportId

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (CommandLine="*CLFS*" OR ParentCommandLine="*CLFS*") // Placeholder, refine based on specific CLFS driver interaction patterns
| (EventCode=4688 OR EventCode=1 OR EventCode=12 OR EventCode=13 OR EventCode=14)
| eval is_priv_escalation = if(match(ParentIntegrityLevel, "(Low|Medium|High)") AND IntegrityLevel="System", "true", "false")
| where is_priv_escalation="true"
| table _time, host, CommandLine, ParentCommandLine, Image, ParentImage, EventCode, IntegrityLevel, ParentIntegrityLevel

Sigma

title: Windows CLFS EoP Attempt
status: experimental
description: Detects potential exploitation attempts of CVE-2021-43226 in the Windows Common Log File System (CLFS) driver leading to privilege escalation.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43226
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\lsass.exe' # Example, refine based on observed exploitation patterns
            - '\services.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'CLFS' # Placeholder, refine based on specific CLFS driver interaction patterns
    condition: selection
level: high

Elastic ES|QL

from logs-windows.*
| where event.category == "process"
| where process.command_line : "*CLFS*" // Placeholder, refine based on specific CLFS driver interaction patterns
| where process.parent.integrity_level != "System" and process.integrity_level == "System" // Look for privilege escalation
| select @timestamp, host.name, process.parent.command_line, process.command_line, process.executable, process.parent.executable, process.integrity_level, process.parent.integrity_level