CVE-2024-21351

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe" or InitiatingProcessFileName =~ "msedge.exe" or InitiatingProcessFileName =~ "chrome.exe" // Or other browsers/applications that might trigger SmartScreen
| where ProcessCommandLine contains ".exe" or ProcessCommandLine contains ".dll" // Looking for execution
| where not (InitiatingProcessIntegrityLevel in ("System", "High")) // Exclude highly privileged processes that might legitimately bypass SmartScreen
| where not (FolderPath contains "Program Files" or FolderPath contains "Windows") // Exclude common legitimate paths
| where ReportId in ( // Example: Look for events where SmartScreen might have been bypassed
    DeviceEvents
    | where ActionType == "SmartScreenBypass" or ActionType == "SmartScreenSkipped" // Placeholder for actual SmartScreen bypass events if available
    | distinct ReportId
)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FolderPath, InitiatingProcessParentFileName

Splunk SPL

index=windows_events (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) OR (sourcetype=WinEventLog:Security EventCode=4688)
| eval ParentProcessName=case(EventCode=1, ParentImage, EventCode=4688, ParentProcessName)
| eval ProcessName=case(EventCode=1, Image, EventCode=4688, NewProcessName)
| eval CommandLine=case(EventCode=1, CommandLine, EventCode=4688, CommandLine)
| where (ParentProcessName="explorer.exe" OR ParentProcessName="msedge.exe" OR ParentProcessName="chrome.exe")
| where (CommandLine LIKE "%.exe%" OR CommandLine LIKE "%.dll%")
| where NOT (ProcessName IN ("svchost.exe", "csrss.exe", "wininit.exe", "lsass.exe")) // Exclude common system processes
| where NOT (ProcessPath LIKE "%Program Files%" OR ProcessPath LIKE "%Windows%")
| table _time, host, ParentProcessName, ProcessName, CommandLine, ProcessPath

Sigma

title: Windows SmartScreen Bypass Attempt
author: SecBoard Operations
date: 2024/07/25
modified: 2024/07/25
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\msedge.exe'
      - '\chrome.exe'
    CommandLine|contains:
      - '.exe'
      - '.dll'
  filter_legit:
    Image|contains:
      - '\Program Files\'
      - '\Windows\'
    ParentImage|contains:
      - '\Program Files\'
      - '\Windows\'
  condition: selection and not filter_legit
fields:
  - CommandLine
  - ParentImage
  - Image
  - User
level: high

Elastic ES|QL

from process where event.type == "start" and 
  (process.parent.executable.name == "explorer.exe" or 
   process.parent.executable.name == "msedge.exe" or 
   process.parent.executable.name == "chrome.exe") and 
  (process.command_line : "*.exe" or process.command_line : "*.dll") and 
  not (process.executable.path : "C:\\Program Files\\*" or 
       process.executable.path : "C:\\Windows\\*")
| select @timestamp, host.name, process.parent.executable.name, process.executable.name, process.command_line, process.executable.path