detection.wiki

Detection rules › Sigma

Potential CVE-2022-26809 Exploitation Attempt

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
ExecutionT1569.002 System Services: Service Execution

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential CVE-2022-26809 Exploitation Attempt
id: a7cd7306-df8b-4398-b711-6f3e4935cf16
status: test
description: Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
    - https://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html
    - https://twitter.com/cyb3rops/status/1514217991034097664
    - https://www.securonix.com/blog/cve-2022-26809-remote-procedure-call-runtime-remote-code-execution-vulnerability-and-coverage/
author: Florian Roth (Nextron Systems)
date: 2022-04-13
modified: 2023-02-03
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1569.002
    - cve.2022-26809
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\System32\svchost.exe'
        ParentCommandLine|contains: '-k RPCSS'
    condition: selection
falsepositives:
    - Unknown
    - Some cases in which the service spawned a werfault.exe process
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    ParentImage: 'C:\Windows\System32\svchost.exe'
    ParentCommandLine|contains: '-k RPCSS'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ParentCommandLinematch
  • -k RPCSS
ParentImageeq
  • C:\Windows\System32\svchost.exe corpus 4 (sigma 3, elastic 1)