CVE-2023-36884

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "SearchIndexer.exe" or InitiatingProcessFileName =~ "SearchProtocolHost.exe"
| where FileName in ("cmd.exe", "powershell.exe", "mshta.exe", "wscript.exe", "cscript.exe") or ProcessCommandLine contains "http" or ProcessCommandLine contains "ftp"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational) (ParentProcessName="SearchIndexer.exe" OR ParentProcessName="SearchProtocolHost.exe") (ProcessName="cmd.exe" OR ProcessName="powershell.exe" OR ProcessName="mshta.exe" OR ProcessName="wscript.exe" OR ProcessName="cscript.exe" OR CommandLine=*http* OR CommandLine=*ftp*)
| table _time, host, ParentProcessName, ProcessName, CommandLine, Image, Hashes

Sigma

title: Windows Search RCE via MOTW Bypass
status: experimental
description: Detects suspicious process creation by Windows Search components, potentially indicating exploitation of CVE-2023-36884.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\SearchIndexer.exe'
      - '\SearchProtocolHost.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - 'http'
      - 'ftp'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - cve.2023.36884

Elastic ES|QL

from process where
  (process.parent.executable.name == "SearchIndexer.exe" or process.parent.executable.name == "SearchProtocolHost.exe") and
  (process.executable.name in ("cmd.exe", "powershell.exe", "mshta.exe", "wscript.exe", "cscript.exe") or process.args contains "http" or process.args contains "ftp")
| select @timestamp, host.name, process.parent.executable.name, process.executable.name, process.command_line, process.hash.sha256