CVE-2025-62221

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "MsMpEng.exe" or FileName =~ "csrss.exe" // Beispiel: Prozesse, die mit Dateisystem-Minifiltern interagieren könnten
| where ProcessCommandLine contains "cloudfiles" or ProcessCommandLine contains "minifilter"
| where InitiatingProcessFileName != "svchost.exe" // Filtert normale Systemaktivitäten
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine, FolderPath

Splunk SPL

index=windows (process_name="MsMpEng.exe" OR process_name="csrss.exe") (command_line="*cloudfiles*" OR command_line="*minifilter*") NOT initiating_process_name="svchost.exe" | stats count by host, initiating_process_name, command_line, parent_process_name

Sigma

title: Windows Cloud Files Mini Filter Driver UAF
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2025-62221 in Windows Cloud Files Mini Filter Driver.
author: SecBoard
date: 2025/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
    CommandLine|contains:
      - 'cloudfiles'
      - 'minifilter'
  filter:
    ParentImage|endswith: '\svchost.exe'
  condition: selection and not filter
level: high

Elastic ES|QL

from process where process.executable : ("*\\MsMpEng.exe", "*\\csrss.exe") and process.args : ("*cloudfiles*", "*minifilter*") and not process.parent.executable : "*\\svchost.exe" | stats count() by host.name, process.parent.executable, process.command_line, process.working_directory