Audit CVE Event

Status: test
Severity: critical
Log source: product windows, service application
Author: Florian Roth (Nextron Systems), Zach Mathis
Source: github.com/SigmaHQ/sigma

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution
Privilege Escalation	`T1068` Exploitation for Privilege Escalation
Stealth	`T1211` Exploitation for Stealth
Credential Access	`T1212` Exploitation for Credential Access
Lateral Movement	`T1210` Exploitation of Remote Services
Impact	`T1499.004` Endpoint Denial of Service: Application or System Exploitation

Telemetry coverage

Provider	Record / event type
Audit-CVE	Event ID 1: Possible detection of CVE: PossibleDetectionOfCVE.

Rule body

title: Audit CVE Event
id: 48d91a3a-2363-43ba-a456-ca71ac3da5c2
status: test
description: |
    Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
    MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
    Unfortunately, that is about the only instance of CVEs being written to this log.
references:
    - https://twitter.com/VM_vivisector/status/1217190929330655232
    - https://twitter.com/DidierStevens/status/1217533958096924676
    - https://twitter.com/FlemmingRiis/status/1217147415482060800
    - https://www.youtube.com/watch?v=ebmW42YYveI # "CVEs in Windows Event Logs? What You Need to Know" by 13Cubed.
    - https://nullsec.us/windows-event-log-audit-cve/
author: Florian Roth (Nextron Systems), Zach Mathis
date: 2020-01-15
modified: 2022-10-22
tags:
    - attack.execution
    - attack.stealth
    - attack.t1203
    - attack.privilege-escalation
    - attack.t1068
    - attack.t1211
    - attack.credential-access
    - attack.t1212
    - attack.lateral-movement
    - attack.t1210
    - attack.impact
    - attack.t1499.004
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name:
            - 'Microsoft-Windows-Audit-CVE'
            - 'Audit-CVE'
        EventID: 1
    condition: selection
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Provider_Name:
        - 'Microsoft-Windows-Audit-CVE'
        - 'Audit-CVE'
    EventID: 1

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Provider_Name`	eq	`Audit-CVE` `Microsoft-Windows-Audit-CVE` corpus 2 (sigma 1, elastic 1)	`field:"Provider_Name" kind:eq`