CVE-2022-41125

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "lsass.exe" or InitiatingProcessCommandLine contains "keyiso.dll"
| where ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "sc.exe" or ProcessCommandLine contains "net.exe"
| where ActionType == "ProcessCreated"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessParentFileName

Splunk SPL

index=windows (InitiatingProcessFileName="lsass.exe" OR InitiatingProcessCommandLine="*keyiso.dll*") (ProcessCommandLine="*powershell*" OR ProcessCommandLine="*cmd.exe*" OR ProcessCommandLine="*sc.exe*" OR ProcessCommandLine="*net.exe*")
| table _time, host, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessParentFileName

Sigma

title: Windows CNG Key Isolation Service Privilege Escalation Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\lsass.exe'
    CommandLine|contains:
      - 'keyiso.dll'
  condition: selection
  filter:
    CommandLine|contains:
      - 'powershell'
      - 'cmd.exe'
      - 'sc.exe'
      - 'net.exe'
level: high

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable == "lsass.exe" or process.parent.command_line : "*keyiso.dll*") and (process.command_line : "*powershell*" or process.command_line : "*cmd.exe*" or process.command_line : "*sc.exe*" or process.command_line : "*net.exe*")
| project @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, user.name