CVE-2024-38226

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "MSPUB.EXE"
| where ProcessCommandLine contains ".docm" or ProcessCommandLine contains ".xlsm" or ProcessCommandLine contains ".pptm" // Beispiel: Suche nach Publisher, der Office-Makro-Dateien öffnet
| where InitiatingProcessCommandLine contains "/m" // Beispiel: Indikator für Makro-Ausführung
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=your_endpoint_logs (process_name="MSPUB.EXE" OR process_name="mspub.exe") (command_line="*.docm*" OR command_line="*.xlsm*" OR command_line="*.pptm*") (parent_command_line="*/m*")
| table _time, host, parent_process_name, parent_command_line, process_name, command_line, file_path

Sigma

title: Microsoft Publisher Macro Bypass Attempt
status: experimental
description: Detects potential attempts to bypass Office macro policies using Microsoft Publisher.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\MSPUB.EXE'
    CommandLine|contains:
      - '.docm'
      - '.xlsm'
      - '.pptm'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
level: high

Elastic ES|QL

FROM process
| WHERE process.executable.name == "MSPUB.EXE"
| WHERE process.args LIKE "%.docm%" OR process.args LIKE "%.xlsm%" OR process.args LIKE "%.pptm%"
| WHERE process.parent.args LIKE "% /m %"
| SELECT @timestamp, host.name, process.parent.executable.name, process.parent.args, process.executable.name, process.args, process.working_directory