CVE-2021-43618

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "mpz_inp_raw" and ProcessCommandLine contains "32-bit" and InitiatingProcessCommandLine contains "crafted input"
| where ActionType == "ProcessTerminated" and ExitCode != 0 // Look for crashes/segmentation faults
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine

Splunk SPL

index=* (mpz_inp_raw AND "32-bit" AND "crafted input") (crash OR "segmentation fault")
| stats count by host, process, command

Sigma

title: GMP Buffer Overflow Crash
author: SecBoard
date: 2023/11/20
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 
      - 'mpz_inp_raw'
      - '32-bit'
      - 'crafted input'
  condition: selection
falsepositives:
  - Legitimate use of GMP with expected crashes (unlikely in production for this specific vulnerability context)
level: high

Elastic ES|QL

from process where process.command_line : "mpz_inp_raw" and process.command_line : "32-bit" and process.command_line : "crafted input" and process.exit_code != 0
| stats count() by host.name, process.executable, process.command_line