CVE-2025-21391

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessFileName =~ "svchost.exe" // Windows Storage Service runs under svchost
| where FileName has_any (".lnk", ".symlink", ".junction") or ActionType == "FileDeleted"
| where FolderPath contains "Windows\\System32\\svchost.exe" // Adjust path if service runs from different location
| summarize count() by DeviceName, InitiatingProcessCommandLine, FileName, ActionType
| where count_ > 5 // Adjust threshold to reduce false positives
| project DeviceName, InitiatingProcessCommandLine, FileName, ActionType, count_

Splunk SPL

index=windows (sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (EventCode=4663 OR EventCode=11) // File deleted or file created (for link creation)
| Image="*\\svchost.exe" // Windows Storage Service runs under svchost
| (TargetFilename IN ("*.lnk", "*.symlink", "*.junction") OR Operation="File Delete")
| stats count by Host, Image, CommandLine, TargetFilename, Operation
| where count > 5 // Adjust threshold to reduce false positives
| table Host, Image, CommandLine, TargetFilename, Operation, count

Sigma

title: Windows Storage Link Following EoP
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential exploitation of CVE-2025-21391 in Windows Storage by monitoring unusual file operations related to symbolic links or file deletions by svchost.exe.
author: SecBoard
date: 2025/02/11
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: '\\svchost.exe'
    TargetFilename|contains:
      - '.lnk'
      - '.symlink'
      - '.junction'
    OR:
      EventType: 'FileDelete'
  condition: selection
falsepositives:
  - Legitimate system operations
level: high

Elastic ES|QL

from file where process.executable.endswith('svchost.exe') and (file.extension in ('.lnk', '.symlink', '.junction') or event.type == 'deletion')
| stats count() by host.name, process.command_line, file.path, event.type
| where count() > 5
| project host.name, process.command_line, file.path, event.type, count()