CVE-2024-38217

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe" or InitiatingProcessFileName =~ "outlook.exe" // Oder andere typische Startprozesse
| where FileName endswith ".lnk" or FileName endswith ".exe" or FileName endswith ".dll" // Oder andere relevante Dateitypen
| where ProcessCommandLine has_any (".lnk", ".exe", ".dll") // Beispiel für LNK-Dateien oder andere ausführbare Dateien
| where not (FolderPath contains "Program Files" or FolderPath contains "Windows") // Filtert bekannte, vertrauenswürdige Pfade
| where not (InitiatingProcessFolderPath contains "Program Files" or InitiatingProcessFolderPath contains "Windows")
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine
| where count_ > 5 // Schwellenwert anpassen, um Rauschen zu reduzieren
| project DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine

Splunk SPL

index=windows_events EventCode=4688 (NewProcessName="*\\explorer.exe" OR NewProcessName="*\\outlook.exe") (CommandLine="*.lnk" OR CommandLine="*.exe" OR CommandLine="*.dll") NOT (NewProcessName="*\\Program Files\\*" OR NewProcessName="*\\Windows\\*") NOT (ParentProcessName="*\\Program Files\\*" OR ParentProcessName="*\\Windows\\*") | stats count by Host, NewProcessName, CommandLine | where count > 5

Sigma

title: Windows MotW Bypass via LNK or Executable
status: experimental
description: Detects potential bypasses of Mark of the Web (MotW) or Smart App Control by monitoring unusual execution of LNK files or other executables that might evade security warnings.
references:
  - https://www.elastic.co/security-labs/dismantling-smart-app-control
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\outlook.exe'
    Image|endswith:
      - '.lnk'
      - '.exe'
      - '.dll'
    CommandLine|contains:
      - '.lnk'
      - '.exe'
      - '.dll'
  filter_legit_paths:
    Image|contains:
      - '\Program Files\'
      - '\Windows\'
    ParentImage|contains:
      - '\Program Files\'
      - '\Windows\'
  condition: selection and not filter_legit_fields
falsepositives:
  - Legitimate software installations or updates.
level: medium

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable == "explorer.exe" or process.parent.executable == "outlook.exe") and (process.executable.endswith(".lnk") or process.executable.endswith(".exe") or process.executable.endswith(".dll")) and (process.command_line.contains(".lnk") or process.command_line.contains(".exe") or process.command_line.contains(".dll")) and not (process.executable.path.starts_with("C:\\Program Files") or process.executable.path.starts_with("C:\\Windows")) and not (process.parent.executable.path.starts_with("C:\\Program Files") or process.parent.executable.path.starts_with("C:\\Windows")) | stats count() by host.name, process.parent.executable, process.executable, process.command_line | where count > 5