CVE-2023-32214

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("firefox.exe", "thunderbird.exe")
| where ProcessCommandLine has_any ("ms-cxh:", "ms-cxh-full:")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FolderPath, FileName

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) OR (sourcetype=WinEventLog:Security EventCode=4688)
| where (ParentProcessName="firefox.exe" OR ParentProcessName="thunderbird.exe") AND (CommandLine LIKE "%ms-cxh:%" OR CommandLine LIKE "%ms-cxh-full:%")
| table _time, Host, ParentProcessName, CommandLine, Image

Sigma

title: Potential DoS via ms-cxh/ms-cxh-full Protocol Handlers
status: experimental
description: Detects attempts to leverage 'ms-cxh' or 'ms-cxh-full' protocol handlers, which could lead to a denial of service in vulnerable Mozilla products on Windows.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32214
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\firefox.exe'
            - '\thunderbird.exe'
        CommandLine|contains:
            - 'ms-cxh:'
            - 'ms-cxh-full:'
    condition: selection
fields:
    - CommandLine
    - ParentImage
    - Image
tags:
    - attack.dos
    - cve.2023.32214

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable == "firefox.exe" or process.parent.executable == "thunderbird.exe") and (process.args contains "ms-cxh:" or process.args contains "ms-cxh-full:") | select @timestamp, host.name, process.parent.executable, process.command_line, process.executable