CVE-2024-38014

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "msiexec.exe"
| where ProcessCommandLine contains "/f" or ProcessCommandLine contains "/repair"
| where ProcessCommandLine contains "/qn" or ProcessCommandLine contains "/qb" // Silent/basic UI repair
| where ProcessCreationTime > ago(7d) // Adjust timeframe as needed
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, ProcessVersionInfoCompanyName, ProcessVersionInfoProductName, AccountName, AccountSid
| join kind=leftouter (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "msiexec.exe"
    | where ProcessCommandLine contains "/f" or ProcessCommandLine contains "/repair"
    | where ProcessCommandLine contains "/qn" or ProcessCommandLine contains "/qb"
    | summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine
    | where count_ > 3 // Look for repeated repair attempts
) on DeviceName, InitiatingProcessFileName, ProcessCommandLine
| where isnotempty(count_)

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (New_Process_Name="*msiexec.exe" OR Parent_Process_Name="*msiexec.exe") (CommandLine="*/f*" OR CommandLine="*/repair*") (CommandLine="*/qn*" OR CommandLine="*/qb*")
| stats count by _time, Host, New_Process_Name, Parent_Process_Name, CommandLine, User
| where count > 3

Sigma

title: Windows MSI Installer Repair Privilege Escalation
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects suspicious activity related to MSI installer repair functions that could indicate an attempt to exploit CVE-2024-38014.
author: SecBoard
date: 2024/09/12
references:
  - https://r.sec-consult.com/msi
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38014
tags:
  - attack.privilege_escalation
  - cve.2024.38014
  - cisa_kev
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\msiexec.exe'
    CommandLine|contains:
      - '/f'
      - '/repair'
    CommandLine|contains:
      - '/qn'
      - '/qb'
  condition: selection
falsepositives:
  - Legitimate software repair operations, especially automated ones.
level: high

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "msiexec.exe" and (process.args contains "/f" or process.args contains "/repair") and (process.args contains "/qn" or process.args contains "/qb") | stats count() by host.name, process.parent.executable, process.command_line, user.name | where count > 3