CVE-2022-21882

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName !in ("explorer.exe", "svchost.exe", "winlogon.exe")
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine contains "-NoProfile" or ProcessCommandLine contains "-ExecutionPolicy Bypass"
| where InitiatingProcessIntegrityLevel == "Medium" and ProcessIntegrityLevel == "System"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessIntegrityLevel, ProcessIntegrityLevel

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 New_Process_Name IN ("cmd.exe", "powershell.exe")
| where Parent_Process_Name != "explorer.exe" AND Parent_Process_Name != "svchost.exe" AND Parent_Process_Name != "winlogon.exe"
| search CommandLine IN ("*-NoProfile*", "*-ExecutionPolicy Bypass*")
| table _time, ComputerName, Parent_Process_Name, New_Process_Name, CommandLine

Sigma

title: Win32k EoP Suspicious Process Creation
status: experimental
description: Detects suspicious process creations indicative of Win32k privilege escalation, where a low-privileged process spawns a high-privileged shell.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\system32\svchost.exe'
      - '\Windows\explorer.exe'
      - '\Windows\System32\winlogon.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: not selection
  falsepositives:
    - Legitimate administrative tools or scripts (requires tuning)
level: high

Elastic ES|QL

from process where event.type == "start" and process.executable.name in ("cmd.exe", "powershell.exe", "pwsh.exe") and not process.parent.executable.name in ("explorer.exe", "svchost.exe", "winlogon.exe") and process.args contains "-NoProfile" or process.args contains "-ExecutionPolicy Bypass"
| project @timestamp, host.name, process.parent.executable.name, process.executable.name, process.args