CVE-2022-24527 Microsoft Connected Cache LPE

Status: test
Severity: high
Log source: category file_event, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: CVE-2022-24527 Microsoft Connected Cache LPE
id: e0a41412-c69a-446f-8e6e-0e6d7483dad7
status: test
description: Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache
references:
    - https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/
author: Florian Roth (Nextron Systems)
date: 2022-04-13
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.t1059.001
    - cve.2022-24527
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: 'WindowsPowerShell\Modules\webAdministration\webAdministration.psm1'
    filter:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetFilename|endswith: 'WindowsPowerShell\Modules\webAdministration\webAdministration.psm1'

Stage 2: `not filter`

filter:
    User|contains:
        - 'AUTHORI'
        - 'AUTORI'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`User`	match	`AUTHORI`	`excludes:User` `field:"User" value:"AUTHORI"`
`User`	match	`AUTORI`	`excludes:User` `field:"User" value:"AUTORI"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`WindowsPowerShell\Modules\webAdministration\webAdministration.psm1`	`field:"TargetFilename" kind:ends_with value:"WindowsPowerShell\Modules\webAdministration\webAdministration.psm1"`