Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2010-0249)

let suspiciousIEProcesses = DeviceProcessEvents
| where FileName =~ "iexplore.exe"
| where InitiatingProcessFileName !in~ ("iexplore.exe", "explorer.exe", "svchost.exe")
| project DeviceId, DeviceName, AccountName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, Timestamp;
let iexploreChildSpawn = DeviceProcessEvents
| where InitiatingProcessFileName =~ "iexplore.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "svchost.exe")
| project DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessId, InitiatingProcessCommandLine, Timestamp;
let iexploreNetworkToSuspicious = DeviceNetworkEvents
| where InitiatingProcessFileName =~ "iexplore.exe"
| where RemotePort !in (80, 443, 8080, 8443)
| project DeviceId, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine, Timestamp;
union iexploreChildSpawn, iexploreNetworkToSuspicious
| sort by Timestamp desc

index=windows (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval EventCode=coalesce(EventCode, event_id)
| where EventCode IN ("1", "3", "7")
| eval ParentImage=lower(coalesce(ParentImage, parent_image, ""))
| eval Image=lower(coalesce(Image, image, ""))
| where ParentImage LIKE "%iexplore.exe"
  AND (Image LIKE "%cmd.exe" OR Image LIKE "%powershell.exe" OR Image LIKE "%wscript.exe" OR Image LIKE "%cscript.exe" OR Image LIKE "%mshta.exe" OR Image LIKE "%regsvr32.exe" OR Image LIKE "%rundll32.exe")
| eval host=coalesce(host, ComputerName)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(Image) as childProcesses values(CommandLine) as commandLines by host, ParentImage, User
| where count > 0
| sort -count

sequence by host.name with maxspan=30s
  [process where process.name : "iexplore.exe" and event.type == "start"]
  [process where process.parent.name : "iexplore.exe" and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime, sourceip, username, "Process Name", "Parent Process Name", "Command", logsourcename(logsourceid) as LogSource
FROM events
WHERE LOWER("Parent Process Name") LIKE '%iexplore.exe'
  AND LOWER("Process Name") IN ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe')
  AND LOGSOURCE_TYPE(logsourceid) IN (12, 13)
LAST 24 HOURS
ORDER BY devicetime DESC

_sourceCategory=windows/sysmon (EventCode=1 OR EventCode=3)
| parse regex field=_raw "<ParentImage>(?<ParentImage>[^<]+)</ParentImage>"
| parse regex field=_raw "<Image>(?<Image>[^<]+)</Image>"
| parse regex field=_raw "<CommandLine>(?<CommandLine>[^<]+)</CommandLine>"
| parse regex field=_raw "<User>(?<User>[^<]+)</User>"
| where toLowerCase(ParentImage) matches "*iexplore.exe"
| where toLowerCase(Image) matches "*cmd.exe" or toLowerCase(Image) matches "*powershell.exe" or toLowerCase(Image) matches "*wscript.exe" or toLowerCase(Image) matches "*mshta.exe" or toLowerCase(Image) matches "*regsvr32.exe"
| count by _sourceHost, ParentImage, Image, User, CommandLine
| sort by _count desc

rule cve_2010_0249_ie_child_process {
  meta:
    author = "df00tech"
    description = "Detects Internet Explorer spawning suspicious child processes consistent with CVE-2010-0249 exploitation"
    severity = "CRITICAL"
    cve = "CVE-2010-0249"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($proc.principal.process.file.full_path, `(?i).*iexplore\.exe$`)
    re.regex($proc.target.process.file.full_path, `(?i).*(cmd|powershell|wscript|cscript|mshta|regsvr32|rundll32)\.exe$`)
  condition:
    $proc
}

event_simpleName=ProcessRollup2
| where ParentBaseFileName = "iexplore.exe"
  and FileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ParentCommandLine
| sort -_time