CVE-2024-2398

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName contains "curl" or FileName contains "curl"
| where RemotePort == 443 or RemotePort == 80
| where Protocol == "Tcp"
| where AdditionalFields contains "HTTP/2 PUSH_PROMISE" // Placeholder for HTTP/2 push detection
| summarize RequestCount = count() by DeviceId, InitiatingProcessFileName, RemoteIP
| where RequestCount > 1000 // Threshold for excessive headers, adjust as needed

Splunk SPL

(sourcetype=network OR sourcetype=process) (process="*curl*" OR dest_port=80 OR dest_port=443) (protocol="tcp") (http2_push_promise=*) | stats count by host, process, dest_ip | where count > 1000

Sigma

title: Curl HTTP/2 Push Header Memory Leak
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential memory leaks in curl due to excessive HTTP/2 push headers.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\curl.exe'
    CommandLine|contains: 'http/2'
  filter:
    CommandLine|contains: 'no-server-push'
  condition: selection and not filter
falsepositives:
  - Legitimate use of HTTP/2 server push with many headers (unlikely to exceed 1000 without malicious intent)
level: medium

Elastic ES|QL

from network.connection
| where process.executable.name : "curl" or destination.port in (80, 443)
| where network.protocol : "tcp"
| where http.version : "2.0" and http.request.method : "PUSH_PROMISE" // Placeholder for HTTP/2 push detection
| stats count() by host.name, process.executable.name, destination.ip
| where count() > 1000