Detection rules › Sigma

Potential CVE-2024-35250 Exploitation Activity

Status
experimental
Severity
medium
Log source
product windows, category image_load
Author
@eyezuhk Isaac Fernandes
Source
github.com/SigmaHQ/sigma

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1068 Exploitation for Privilege Escalation

Event coverage

ProviderEventTitle
SysmonEvent ID 7Image loaded

Rule body yaml

title: Potential CVE-2024-35250 Exploitation Activity
id: 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
status: experimental
description: |
    Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
references:
    - https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
    - https://github.com/varwara/CVE-2024-35250
    - https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: '@eyezuhk Isaac Fernandes'
date: 2025-02-19
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2024-35250
    - detection.emerging-threats
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\ksproxy.ax'
    filter_main_system_paths:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_teams:
        Image|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
    filter_optional_zoom:
        Image|endswith: '\AppData\Roaming\Zoom\bin\Zoom.exe'
    filter_optional_firefox:
        Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
    filter_optional_chrome:
        Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
    filter_optional_opera:
        Image|endswith: '\AppData\Local\Programs\Opera\opera.exe'
    filter_optional_discord:
        Image|endswith: '\AppData\Local\Discord\app-*\Discord.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate applications that use Windows Stream Interface APIs.
    - Media applications that use DirectShow filters.
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    ImageLoaded|endswith: '\ksproxy.ax'

Stage 2: not filter_main_system_paths

filter_main_system_paths:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'

Stage 3: not filter_optional_*

filter_optional_teams:
    Image|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
filter_optional_zoom:
    Image|endswith: '\AppData\Roaming\Zoom\bin\Zoom.exe'
filter_optional_firefox:
    Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
filter_optional_chrome:
    Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
filter_optional_opera:
    Image|endswith: '\AppData\Local\Programs\Opera\opera.exe'
filter_optional_discord:
    Image|endswith: '\AppData\Local\Discord\app-*\Discord.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imagestarts_withC:\Program Files (x86)\
Imagestarts_withC:\Program Files\
Imagestarts_withC:\Windows\SysWOW64\
Imagestarts_withC:\Windows\System32\
Imageends_with\AppData\Local\Discord\app-*\Discord.exe
Imageends_with\AppData\Local\Google\Chrome\Application\chrome.exe
Imageends_with\AppData\Local\Microsoft\Teams\current\Teams.exe
Imageends_with\AppData\Local\Mozilla Firefox\firefox.exe
Imageends_with\AppData\Local\Programs\Opera\opera.exe
Imageends_with\AppData\Roaming\Zoom\bin\Zoom.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImageLoadedends_with
  • \ksproxy.ax