CVE-2024-28757

Sentinel/Defender KQL

DeviceFileEvents
| where FileName endswith ".xml" or FileName endswith ".dtd"
| where FileContent contains "<!DOCTYPE" and FileContent contains "SYSTEM" and FileContent contains "ENTITY" and FileContent contains "%p1 '%p1'" // Simplified pattern for recursive entity
| project Timestamp, DeviceName, FileName, FolderPath, FileContent
| extend ThreatType = "CVE-2024-28757 XML Entity Expansion Attempt"

Splunk SPL

index=* (sourcetype=xml OR sourcetype=dtd) "<!DOCTYPE" "SYSTEM" "ENTITY" "%p1 '%p1'"
| table _time, host, source, _raw
| rename _raw as FileContent
| eval ThreatType = "CVE-2024-28757 XML Entity Expansion Attempt"

Sigma

title: LibExpat XML Entity Expansion Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential XML Entity Expansion (Billion Laughs) attacks targeting libexpat, specifically looking for recursive entity definitions in external DTDs.
author: SecBoard
date: 2024/07/30
logsource:
  category: file_event
  product: windows
detection:
  selection:
    EventID: 11
    TargetFilename|endswith: ['.xml', '.dtd']
    Image|endswith: ['\parser.exe', '\xml_processor.exe'] # Example processes that might use libexpat
    CommandLine|contains: ['<!DOCTYPE', 'SYSTEM', 'ENTITY', '%p1 \'%p1\'']
  condition: selection
fields:
  - Image
  - TargetFilename
  - CommandLine
tags:
  - attack.defense_evasion
  - attack.impact
  - cve.2024.28757
  - doi.denial_of_service

Elastic ES|QL

from file where file.extension in ("xml", "dtd") and file.content : ("<!DOCTYPE", "SYSTEM", "ENTITY", "%p1 '%p1'")
| project @timestamp, host.name, file.path, file.content
| append { from process where process.args : ("<!DOCTYPE", "SYSTEM", "ENTITY", "%p1 '%p1'") and process.executable : ("*parser*", "*xml_processor*")
| project @timestamp, host.name, process.executable, process.args }
| set threat.type = "CVE-2024-28757 XML Entity Expansion Attempt"