CVE-2010-0806 Microsoft Internet Explorer Use-After-Free Exploitation

let suspiciousIEProcesses = DeviceProcessEvents
| where FileName =~ "iexplore.exe"
| where InitiatingProcessFileName !in~ ("explorer.exe", "iexplore.exe", "userinit.exe")
| project DeviceId, DeviceName, Timestamp, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
let ieSuspiciousChildren = DeviceProcessEvents
| where InitiatingProcessFileName =~ "iexplore.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "svchost.exe")
| project DeviceId, DeviceName, Timestamp, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, AccountName;
let ieNetworkAfterSpawn = DeviceNetworkEvents
| where InitiatingProcessFileName =~ "iexplore.exe"
| where RemotePort in (80, 443, 8080, 4444, 1337)
| project DeviceId, DeviceName, Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
ieSuspiciousChildren
| union suspiciousIEProcesses
| union ieNetworkAfterSpawn
| summarize count() by DeviceId, DeviceName, FileName, InitiatingProcessFileName, bin(Timestamp, 5m)
| where count_ > 0
| order by count_ desc

index=endpoint sourcetype=xmlwineventlog OR sourcetype=wineventlog EventCode=4688
| eval parent=lower(ParentProcessName), child=lower(NewProcessName)
| where parent="*iexplore.exe*"
| where child IN ("*cmd.exe*", "*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*mshta.exe*", "*regsvr32.exe*", "*rundll32.exe*")
| eval risk_score=case(
    child="*powershell.exe*", 90,
    child="*cmd.exe*", 80,
    child="*mshta.exe*", 85,
    true(), 70)
| stats count min(_time) as first_seen max(_time) as last_seen values(child) as child_processes values(CommandLine) as commandlines by ComputerName, parent, AccountName, risk_score
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table ComputerName, AccountName, parent, child_processes, commandlines, count, risk_score, first_seen, last_seen
| sort - risk_score

sequence by host.id with maxspan=2m
  [process where process.name : "iexplore.exe" and event.type == "start"]
  [process where process.parent.name : "iexplore.exe" and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe") and
   event.type == "start"]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
       sourceip, destinationip,
       "ParentProcessPath", "ProcessPath", "CommandLine",
       username, hostname
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND "ParentProcessPath" ILIKE '%iexplore.exe'
  AND ("ProcessPath" ILIKE '%cmd.exe'
       OR "ProcessPath" ILIKE '%powershell.exe'
       OR "ProcessPath" ILIKE '%wscript.exe'
       OR "ProcessPath" ILIKE '%cscript.exe'
       OR "ProcessPath" ILIKE '%mshta.exe'
       OR "ProcessPath" ILIKE '%regsvr32.exe'
       OR "ProcessPath" ILIKE '%rundll32.exe')
  AND QIDNAME(qid) = 'Process Launch'
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=windows/events OR _sourceCategory=sysmon
| json field=_raw "EventID", "ParentImage", "Image", "CommandLine", "User", "ComputerName" nodrop
| where ParentImage matches "*iexplore.exe*"
| where Image matches "*cmd.exe*" OR Image matches "*powershell.exe*" OR Image matches "*wscript.exe*" OR Image matches "*cscript.exe*" OR Image matches "*mshta.exe*" OR Image matches "*regsvr32.exe*" OR Image matches "*rundll32.exe*"
| count by ComputerName, User, ParentImage, Image, CommandLine
| sort by _count desc
| fields ComputerName, User, ParentImage, Image, CommandLine, _count

rule cve_2010_0806_ie_uaf_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2010-0806 IE use-after-free exploitation via suspicious child process spawning"
    severity = "CRITICAL"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2010-0806"
  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    $parent.principal.process.file.full_path = /(?i)iexplore\.exe$/
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.parent_process.file.full_path = /(?i)iexplore\.exe$/
    $child.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|regsvr32|rundll32)\.exe$/
    $parent.principal.hostname = $child.principal.hostname
  match:
    $parent.principal.hostname over 2m
  condition:
    $parent and $child
}

event_platform=Win event_simpleName=ProcessRollup2
| search ParentBaseFileName="iexplore.exe"
| search FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")
| eval risk=case(
    FileName=="powershell.exe", "HIGH",
    FileName=="mshta.exe", "HIGH",
    FileName=="cmd.exe", "MEDIUM",
    true(), "MEDIUM")
| stats count by ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, risk
| sort - count