CVE-2025-21335

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "vmwp.exe" or InitiatingProcessFileName =~ "vmsrvc.exe" // Or other relevant Hyper-V processes
| where ProcessCommandLine contains "-vsp" or ProcessCommandLine contains "-integration" // Look for VSP/integration related arguments
| where ProcessIntegrityLevel == "System" and InitiatingProcessIntegrityLevel != "System" // Detect privilege escalation to SYSTEM
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessIntegrityLevel, AccountName

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Hyper-V-VMMS/Operational OR sourcetype=WinEventLog:Microsoft-Windows-Hyper-V-Worker/Operational OR sourcetype=WinEventLog:Security)
| search (EventCode=4688 AND NewProcessName IN ("*vmwp.exe", "*vmsrvc.exe")) OR (EventCode=5145 AND ObjectName IN ("*vsp*", "*integration*"))
| eval is_system_privilege = if(match(TokenElevationType, "%%1936"), "System", "Other")
| where is_system_privilege = "System" AND NOT (InitiatingProcessIntegrityLevel = "System")
| table _time, host, EventCode, ProcessName, NewProcessName, CommandLine, TokenElevationType, InitiatingProcessIntegrityLevel

Sigma

title: Hyper-V NT Kernel Integration VSP Privilege Escalation
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential privilege escalation attempts via Hyper-V NT Kernel Integration VSP vulnerability.
author: SecBoard
date: 2025/01/14
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\vmwp.exe'
      - '\vmsrvc.exe'
    CommandLine|contains:
      - '-vsp'
      - '-integration'
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - User
tags:
  - attack.privilege_escalation
  - cve.2025.21335
  - cisa_kev
level: high

Elastic ES|QL

FROM process
| WHERE event.action == "process_started"
| WHERE process.parent.executable.endswith("\\vmwp.exe") OR process.parent.executable.endswith("\\vmsrvc.exe")
| WHERE process.command_line.contains("-vsp") OR process.command_line.contains("-integration")
| WHERE process.integrity_level == "System" AND process.parent.integrity_level != "System"
| SELECT @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, process.integrity_level, process.parent.integrity_level, user.name