Potential CVE-2024-21412 Exploitation

[rule]
description = """
Identifies a url file download via WebDAV followed by the creation of executable content via WinINET. This may indicate
the successful exploitation of the vulnerability CVE-2024-21412. CVE-2024-21412 allows attackers to bypass the Microsoft
Defender SmartScreen security feature with booby-trapped Internet Shortcut files.
"""
id = "ad1cd9c5-f440-4f70-baa9-3f262d5ea414"
license = "Elastic License v2"
name = "Potential CVE-2024-21412 Exploitation"
os_list = ["windows"]
reference = [
    "https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html",
    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412",
]
version = "1.0.3"

query = '''
sequence with maxspan=1m
 [file where event.action == "creation" and process.name : ("explorer.exe", "winrar.exe", "7zfm.exe") and
  file.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" and
  (file.extension : ("exe", "pif", "scr", "js", "vbs", "wsh", "hta", "cpl", "jse", "vbe", "bat", "cmd", "dll", "msi") or
   file.Ext.header_bytes : "4d5a*")]
 [file where process.name : "svchost.exe" and file.extension == "url" and
  file.path : "?:\\WINDOWS\\*\\TfsStore\\Tfs_DAV\\{*}.url"]
'''

actions = []
min_endpoint_version = "8.4.0"
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.4.0"