CVE-2023-21823

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("dwm.exe", "csrss.exe", "winlogon.exe") // Beispiel: Prozesse, die mit Grafikkomponenten interagieren könnten
| where ProcessCommandLine has_any ("powershell", "cmd", "wmic") // Beispiel: Ungewöhnliche Befehle nach Prozessstart
| where ActionType == "ProcessCreated" or ActionType == "FileCreated" or ActionType == "RegistryValueSet"
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine, ActionType

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (Image="*\\dwm.exe" OR Image="*\\csrss.exe" OR Image="*\\winlogon.exe") // Beispiel: Prozesse, die mit Grafikkomponenten interagieren könnten
| (CommandLine="*powershell*" OR CommandLine="*cmd*" OR CommandLine="*wmic*") // Beispiel: Ungewöhnliche Befehle nach Prozessstart
| stats count by host, Image, CommandLine, EventCode

Sigma

title: Windows Graphics Component Privilege Escalation Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\dwm.exe'
      - '\csrss.exe'
      - '\winlogon.exe'
    CommandLine|contains:
      - 'powershell'
      - 'cmd'
      - 'wmic'
  condition: selection
falsepositives:
  - Legitimate administrative activity (requires tuning)
level: high

Elastic ES|QL

from logs-windows.*
| where event.category == "process"
| where process.parent.executable.endswith("dwm.exe") or process.parent.executable.endswith("csrss.exe") or process.parent.executable.endswith("winlogon.exe")
| where process.command_line.contains("powershell") or process.command_line.contains("cmd") or process.command_line.contains("wmic")
| stats count() by host.name, process.parent.executable, process.command_line, event.action