MS08-067 NetAPI Buffer Overflow Exploitation Attempt (CVE-2008-4250)

let timeWindow = 1h;
let suspiciousRPCPorts = dynamic(["445", "139", "135"]);
union
(
  DeviceNetworkEvents
  | where TimeGenerated >= ago(timeWindow)
  | where RemotePort in (suspiciousRPCPorts)
  | where ActionType == "ConnectionSuccess"
  | summarize ConnectionCount = count(), DistinctTargets = dcount(DeviceName) by InitiatingProcessFileName, RemoteIP, RemotePort, bin(TimeGenerated, 5m)
  | where ConnectionCount > 10 or DistinctTargets > 5
  | extend DetectionReason = "High-frequency SMB/RPC lateral connection sweep"
),
(
  DeviceProcessEvents
  | where TimeGenerated >= ago(timeWindow)
  | where InitiatingProcessFileName =~ "svchost.exe"
  | where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")
  | where InitiatingProcessCommandLine has_any ("netsvcs", "netapi")
  | extend DetectionReason = "Suspicious child process spawned from netapi/svchost context"
),
(
  SecurityEvent
  | where TimeGenerated >= ago(timeWindow)
  | where EventID in (4624, 4625)
  | where LogonType == 3
  | where IpAddress != "-" and IpAddress != "127.0.0.1"
  | summarize FailCount = countif(EventID == 4625), SuccessCount = countif(EventID == 4624) by IpAddress, bin(TimeGenerated, 5m)
  | where FailCount > 20
  | extend DetectionReason = "Brute-force or exploit scan via SMB network logon"
)
| project TimeGenerated, DetectionReason, InitiatingProcessFileName, FileName, RemoteIP, RemotePort, ConnectionCount, IpAddress

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
| eval detection_source=sourcetype
| eval event_time=_time
| where (EventCode=4624 OR EventCode=4625 OR EventCode=4688 OR EventCode=7045 OR EventCode=1)
| eval is_smb_auth=if(EventCode IN (4624,4625) AND Logon_Type="3", 1, 0)
| eval is_proc_create=if(EventCode=4688 OR EventCode=1, 1, 0)
| eval is_service_install=if(EventCode=7045, 1, 0)
| eval suspicious_parent=if(is_proc_create=1 AND (ParentProcessName LIKE "%svchost%" OR ParentImage LIKE "%svchost%") AND (NewProcessName LIKE "%cmd.exe" OR NewProcessName LIKE "%powershell.exe" OR Process_Name LIKE "%cmd.exe" OR CommandLine LIKE "%cmd%"), 1, 0)
| stats count AS total_events,
        sum(is_smb_auth) AS smb_auth_events,
        sum(is_proc_create) AS proc_create_events,
        sum(is_service_install) AS service_installs,
        sum(suspicious_parent) AS suspicious_parent_procs,
        dc(IpAddress) AS distinct_src_ips,
        values(IpAddress) AS src_ips,
        values(NewProcessName) AS new_processes
        BY host, span=5m
| where suspicious_parent_procs > 0 OR service_installs > 2 OR (smb_auth_events > 50 AND distinct_src_ips > 5)
| eval risk_score=case(
    suspicious_parent_procs > 0 AND service_installs > 0, 95,
    suspicious_parent_procs > 0, 80,
    service_installs > 2, 70,
    smb_auth_events > 50, 60,
    true(), 50)
| eval detection_reason=case(
    suspicious_parent_procs > 0, "Suspicious process spawned from svchost - possible MS08-067 RCE",
    service_installs > 2, "Multiple service installs - possible Conficker/worm persistence",
    smb_auth_events > 50, "High-volume SMB auth events - possible exploitation scan",
    true(), "Anomalous Windows event pattern")
| table _time, host, detection_reason, risk_score, smb_auth_events, suspicious_parent_procs, service_installs, src_ips, new_processes

sequence by host.name with maxspan=2m
  [network where network.transport == "tcp" and destination.port in (445, 139, 135)
   and not source.ip == "127.0.0.1"
   | where true] with runs=10
  [process where event.type == "start"
   and process.parent.name == "svchost.exe"
   and process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
   and not process.args : ("*WindowsUpdate*", "*wuauclt*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  category,
  logsourcename(logsourceid) AS log_source,
  COUNT(*) AS event_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Windows Event Log')
  AND (
    (eventid IN (4624, 4625) AND "Logon Type" = '3' AND sourceip IS NOT NULL AND sourceip != '127.0.0.1')
    OR
    (eventid = 4688 AND "New Process Name" LIKE '%cmd.exe' AND "Creator Process Name" LIKE '%svchost.exe')
    OR
    (eventid = 7045)
  )
  AND starttime > NOW() - 3600000
GROUP BY
  sourceip, destinationip, destinationport, username, qid, category, logsourceid
HAVING
  (eventid IN (4624, 4625) AND event_count > 20)
  OR eventid IN (4688, 7045)
ORDER BY event_time DESC
LIMIT 1000

_sourceCategory=windows/security OR _sourceCategory=windows/system
| parse "EventCode=*" as event_code nodrop
| parse "LogonType=*" as logon_type nodrop
| parse "IpAddress=*" as src_ip nodrop
| parse "NewProcessName=*" as new_process nodrop
| parse "ParentProcessName=*" as parent_process nodrop
| parse "ServiceName=*" as service_name nodrop
| where event_code in ("4624", "4625", "4688", "7045")
| eval is_smb_logon = if(event_code in ("4624","4625") and logon_type == "3", 1, 0)
| eval is_suspicious_proc = if(event_code == "4688" and parent_process matches "*svchost*" and new_process matches "*(cmd.exe|powershell.exe|wscript.exe)*", 1, 0)
| eval is_service_install = if(event_code == "7045", 1, 0)
| timeslice 5m
| stats sum(is_smb_logon) as smb_logons,
        sum(is_suspicious_proc) as suspicious_procs,
        sum(is_service_install) as service_installs,
        dcount(src_ip) as unique_src_ips
        by _timeslice, _sourceHost
| where suspicious_procs > 0 or service_installs > 3 or (smb_logons > 30 and unique_src_ips > 3)
| eval alert_reason = if(suspicious_procs > 0, "Suspicious svchost child process - possible MS08-067 RCE",
                      if(service_installs > 3, "Multiple service installs - possible Conficker persistence",
                      "High SMB logon volume - exploitation scan"))
| fields _timeslice, _sourceHost, alert_reason, smb_logons, suspicious_procs, service_installs, unique_src_ips

rule ms08_067_netapi_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects MS08-067 (CVE-2008-4250) NetAPI buffer overflow exploitation patterns"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"
    cve = "CVE-2008-4250"
    mitre_attack_id = "T1210"

  events:
    (
      $network_event.metadata.event_type = "NETWORK_CONNECTION"
      and $network_event.target.port in (445, 139, 135)
      and not $network_event.principal.ip = "127.0.0.1"
      and $network_event.metadata.vendor_name = "Microsoft"
    ) and (
      $proc_event.metadata.event_type = "PROCESS_LAUNCH"
      and $proc_event.principal.process.file.full_path = /svchost\.exe$/
      and $proc_event.target.process.file.full_path = /(cmd|powershell|wscript|cscript|rundll32)\.exe$/
    )
    and $network_event.target.hostname = $proc_event.principal.hostname
    and $network_event.metadata.event_timestamp.seconds <
        $proc_event.metadata.event_timestamp.seconds
    and ($proc_event.metadata.event_timestamp.seconds -
         $network_event.metadata.event_timestamp.seconds) <= 120

  condition:
    $network_event and $proc_event
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName="svchost.exe"
| FileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")
| CommandLine != "*wuauclt*"
| CommandLine != "*WindowsUpdate*"
| join type=inner (
    #event_simpleName=NetworkConnectIP4
    | RemotePort in (445, 139, 135)
    | LocalPort > 1024
    | stats count() as smb_connection_count by aid, RemoteAddressIP4
    | where smb_connection_count > 5
  ) by aid
| eval risk_level=case(
    smb_connection_count > 20 and FileName="cmd.exe", "CRITICAL",
    smb_connection_count > 10, "HIGH",
    true(), "MEDIUM")
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, smb_connection_count, risk_level
| sort -smb_connection_count