CVE-2023-36424 - Microsoft Windows Out-of-Bounds Read Exploitation

let timeWindow = 24h;
let suspiciousProcesses = dynamic(["werfault.exe", "ntoskrnl.exe", "lsass.exe", "csrss.exe"]);
union
(
    SecurityEvent
    | where TimeGenerated >= ago(timeWindow)
    | where EventID in (4688, 4625, 4672)
    | where NewProcessName has_any ("werfault.exe", "ReportFault") or SubjectLogonId != "0x3e7"
    | where SubjectUserName !endswith "$"
    | project TimeGenerated, EventID, SubjectUserName, SubjectLogonId, NewProcessName, ProcessId, Computer
),
(
    DeviceProcessEvents
    | where Timestamp >= ago(timeWindow)
    | where FileName =~ "werfault.exe" or InitiatingProcessFileName in~ (suspiciousProcesses)
    | where AccountName !endswith "$"
    | project Timestamp, DeviceName, AccountName, FileName, ProcessId, InitiatingProcessFileName, InitiatingProcessId, ProcessCommandLine
),
(
    DeviceEvents
    | where Timestamp >= ago(timeWindow)
    | where ActionType == "MemoryAccessViolation" or ActionType == "ExploitGuardNullPage"
    | project Timestamp, DeviceName, AccountName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| where isnotempty(Computer) or isnotempty(DeviceName)

index=wineventlog OR index=sysmon sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval event_time=_time
| where earliest=-24h
| eval is_crash_event=if(EventCode=="1000" OR EventCode=="1001" OR (EventCode=="4688" AND like(NewProcessName, "%werfault%")), 1, 0)
| eval is_privesc=if(EventCode=="4672" AND NOT like(SubjectUserName, "%$"), 1, 0)
| eval is_memory_violation=if(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode="11" AND (like(TargetFilename, "%Watson%") OR like(TargetFilename, "%CrashDumps%")), 1, 0)
| eval risk_score=is_crash_event + is_privesc + is_memory_violation
| where risk_score >= 1
| stats count as event_count, sum(is_crash_event) as crash_events, sum(is_privesc) as privesc_events, sum(is_memory_violation) as memory_events, values(host) as hosts, values(SubjectUserName) as users by ComputerName
| where event_count > 0
| eval cve="CVE-2023-36424"
| table _time, ComputerName, hosts, users, event_count, crash_events, privesc_events, memory_events, cve

sequence by host.name with maxspan=10m
  [process where event.action == "start" and
   (process.name : "werfault.exe" or process.parent.name : "werfault.exe") and
   not user.name : ("*$", "SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")]
  [any where event.action in ("access_violation", "privilege_escalation") or
   (event.code == "4672" and not user.name : "*$") or
   (event.code == "4688" and process.name : ("cmd.exe", "powershell.exe", "mshta.exe"))]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "Computer Name" AS computer_name,
  QIDNAME(qid) AS event_name,
  qid,
  sourceip,
  "Process Name" AS process_name,
  COUNT(*) AS event_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Windows Event Log')
  AND (
    qid IN (5000672, 5000001000, 5000001001, 5004688)
    OR LOWER("Process Name") LIKE '%werfault%'
    OR LOWER("Process Name") LIKE '%reportfault%'
  )
  AND NOT LOWER(username) LIKE '%$'
  AND starttime > NOW() - 86400000
GROUP BY
  computer_name, username, process_name, qid
HAVING event_count > 0
ORDER BY event_time DESC
LAST 24 HOURS

_sourceCategory=Windows/Security OR _sourceCategory=Windows/Sysmon
| where _sourceCategory matches "Windows*"
| json auto
| where %"EventID" in ("4688", "4672", "1000", "1001") or %"Event.System.EventID" in ("4688", "4672", "1000", "1001")
| where !matches(%"SubjectUserName", "*$") or !matches(%"User", "*$")
| where %"NewProcessName" matches "*werfault*" or %"Image" matches "*werfault*" or %"EventID" == "4672"
| eval cve = "CVE-2023-36424"
| eval risk = if(%"EventID" == "4672", "privilege_escalation", if(%"NewProcessName" matches "*werfault*", "crash_artifact", "unknown"))
| stats count as hit_count, values(%"Computer") as computers, values(%"SubjectUserName") as users by %"EventID", risk, cve
| where hit_count > 0
| sort by hit_count desc

rule cve_2023_36424_windows_oob_read {
  meta:
    author = "df00tech"
    description = "Detects CVE-2023-36424 exploitation indicators: Windows OOB read vulnerability"
    severity = "HIGH"
    priority = "HIGH"
    cve = "CVE-2023-36424"
    reference = "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      AND (
        re.regex($e.target.process.file.full_path, `(?i)werfault\.exe$`)
        OR re.regex($e.target.process.file.full_path, `(?i)reportfault\.exe$`)
      )
      AND NOT re.regex($e.principal.user.userid, `(?i).*\$$`)
    )
    OR
    (
      $e.metadata.event_type = "USER_UNCATEGORIZED"
      AND $e.metadata.product_event_type = "4672"
      AND NOT re.regex($e.principal.user.userid, `(?i).*\$$`)
      AND NOT $e.principal.user.userid = "SYSTEM"
    )

  condition:
    $e
}

#event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2", "CrashAnalysisNotification")
| filter FileName IN ("werfault.exe", "WerFault.exe", "ReportFault.exe")
   OR (#event_simpleName = "UserLogon" AND LogonType_decimal != "5" AND NOT UserName ends with "$")
   OR (#event_simpleName = "CrashAnalysisNotification")
| eval risk_indicator = case(
    FileName IN ("werfault.exe", "WerFault.exe"), "crash_artifact",
    #event_simpleName = "CrashAnalysisNotification", "crash_notification",
    #event_simpleName = "UserLogon", "interactive_logon",
    true(), "unknown"
  )
| stats count() as event_count, values(UserName) as users, values(ComputerName) as hosts by risk_indicator, FileName
| where event_count > 0
| eval cve = "CVE-2023-36424"
| table cve, risk_indicator, FileName, event_count, users, hosts