Adobe Acrobat Use-After-Free Exploitation (CVE-2020-9715)

let AcrobatProcs = dynamic(["AcroRd32.exe", "Acrobat.exe", "AcroCEF.exe", "AcroNGL.exe"]);
let SuspChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe", "wmic.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AcrobatProcs)
| where FileName in~ (SuspChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend AlertDetail = strcat("Adobe Acrobat spawned suspicious child process: ", FileName)
| order by TimeGenerated desc

index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| eval ParentImage=lower(ParentImage), Image=lower(Image)
| where like(ParentImage, "%acrobat%") OR like(ParentImage, "%acrord32%") OR like(ParentImage, "%acrocef%")
| where like(Image, "%cmd.exe") OR like(Image, "%powershell.exe") OR like(Image, "%wscript.exe") OR like(Image, "%cscript.exe") OR like(Image, "%mshta.exe") OR like(Image, "%rundll32.exe") OR like(Image, "%regsvr32.exe") OR like(Image, "%certutil.exe") OR like(Image, "%bitsadmin.exe") OR like(Image, "%wmic.exe")
| table _time, host, User, ParentImage, ParentCommandLine, Image, CommandLine
| sort -_time

sequence by host.name with maxspan=30s
  [process where event.type == "start"
    and process.name : ("Acrobat.exe", "AcroRd32.exe", "AcroCEF.exe", "AcroNGL.exe")]
  [process where event.type == "start"
    and process.parent.name : ("Acrobat.exe", "AcroRd32.exe", "AcroCEF.exe", "AcroNGL.exe")
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Parent Process Name", "Command"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%sysmon%'
  AND ("Parent Process Name" ILIKE '%acrobat%' OR "Parent Process Name" ILIKE '%acrord32%' OR "Parent Process Name" ILIKE '%acrocef%')
  AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%wscript.exe%' OR "Process Name" ILIKE '%mshta.exe%' OR "Process Name" ILIKE '%rundll32.exe%' OR "Process Name" ILIKE '%certutil.exe%')
LAST 7 DAYS
ORDER BY devicetime DESC

_sourceCategory=windows/sysmon EventID=1
| parse field=Message "ParentImage: *\n" as ParentImage
| parse field=Message "Image: *\n" as ChildImage
| parse field=Message "CommandLine: *\n" as CommandLine
| where (ParentImage matches "*Acrobat*" or ParentImage matches "*AcroRd32*" or ParentImage matches "*AcroCEF*")
  and (ChildImage matches "*cmd.exe*" or ChildImage matches "*powershell.exe*" or ChildImage matches "*wscript.exe*" or ChildImage matches "*mshta.exe*" or ChildImage matches "*rundll32.exe*" or ChildImage matches "*certutil.exe*")
| project _messageTime, _sourceHost, ParentImage, ChildImage, CommandLine
| order by _messageTime desc

rule adobe_acrobat_uaf_child_process_cve_2020_9715 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Adobe Acrobat spawning suspicious child processes, indicative of CVE-2020-9715 use-after-free exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(Acrobat\.exe|AcroRd32\.exe|AcroCEF\.exe|AcroNGL\.exe)$/
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.parent_process.file.full_path = /(?i)(Acrobat\.exe|AcroRd32\.exe|AcroCEF\.exe|AcroNGL\.exe)$/
    $child.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe)$/
    $proc.metadata.collected_timestamp.seconds = $child.metadata.collected_timestamp.seconds
  condition:
    $proc and $child
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName IN ("Acrobat.exe", "AcroRd32.exe", "AcroCEF.exe", "AcroNGL.exe")
  AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe")
| table _time, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine
| sort -_time