CVE-2021-46143

Sentinel/Defender KQL

// Generic example for detecting application crashes or high resource usage related to XML processing
// Customize 'YourApplicationLogs' and filter for relevant error messages or process metrics.
YourApplicationLogs
| where Message contains "XML parsing error" or Message contains "integer overflow" or Message contains "realloc acting as free"
| extend ProcessName = tostring(split(Message, "Process:")[1])
| summarize EventCount = count() by bin(TimeGenerated, 1h), ProcessName, Message
| where EventCount > 5 // Adjust threshold based on normal behavior
| project TimeGenerated, ProcessName, Message, EventCount

Splunk SPL

# Generic example for detecting application crashes or high resource usage related to XML processing
# Customize 'your_application_logs' and filter for relevant error messages or process metrics.
your_application_logs (xml parsing error OR "integer overflow" OR "realloc acting as free")
| stats count by _time, host, source, sourcetype, message
| where count > 5 # Adjust threshold based on normal behavior

Sigma

title: Expat Integer Overflow Detection
id: 00000000-0000-0000-0000-000000000000 # Placeholder: Generate a unique GUID
status: experimental
description: Detects potential exploitation attempts of Expat integer overflow vulnerabilities by looking for application crashes or high resource usage during XML processing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-46143
logsource:
  category: process_creation
  product: windows # Or linux, depending on the target system
detection:
  keywords:
    - 'xmlparse.c'
    - 'doProlog'
    - 'integer overflow'
    - 'realloc acting as free'
    - 'denial of service'
  condition: keywords
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
timeframe: 5m
level: high

Elastic ES|QL

// Generic example for detecting application crashes or high resource usage related to XML processing
// Customize 'your_application_logs' and filter for relevant error messages or process metrics.
FROM your_application_logs
| WHERE message : "XML parsing error" OR message : "integer overflow" OR message : "realloc acting as free"
| GROUP BY @timestamp, host.name, service.name, message
| AGG count() AS event_count
| WHERE event_count > 5 // Adjust threshold based on normal behavior
| SORT BY @timestamp DESC