CVE-2024-26234 — Windows Proxy Driver Spoofing via Malicious Signed Driver

let suspiciousDrivers = DeviceEvents
| where ActionType == "DriverLoad"
| where InitiatingProcessFileName !in~ ("System", "smss.exe", "services.exe")
| project DeviceId, Timestamp, FileName, FolderPath, SHA256, InitiatingProcessFileName;
let signedByMicrosoft = suspiciousDrivers
| join kind=leftouter (
    DeviceFileCertificateInfo
    | where Signer contains "Microsoft" or Signer contains "Windows"
    | project SHA256, Signer, SignerHash, IsTrusted
) on SHA256
| where IsTrusted == true;
signedByMicrosoft
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort in (80, 443, 1080, 8080, 8443)
    | where InitiatingProcessFileName endswith ".sys" or RemoteUrl contains "proxy"
    | project DeviceId, NetworkTimestamp=Timestamp, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
) on DeviceId
| where abs(datetime_diff('minute', Timestamp, NetworkTimestamp)) < 30
| project Timestamp, DeviceId, DriverFile=FileName, FolderPath, SHA256, Signer, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

index=windows sourcetype=WinEventLog:Security EventCode=7045
| eval DriverPath=lower(ServiceFileName)
| where match(DriverPath, "\.sys$")
| eval SHA256=lower(coalesce(SHA256, "unknown"))
| join type=left SHA256 [
    search index=windows sourcetype=WinEventLog:Security EventCode=7045 OR sourcetype=XmlWinEventLog:Microsoft-Windows-CodeIntegrity/Operational
    | eval cert_signer=lower(coalesce(SignerName, SubjectName, "unknown"))
    | where match(cert_signer, "microsoft")
    | stats count by SHA256, cert_signer
]
| where cert_signer like "%microsoft%"
| join type=inner ServiceName [
    search index=windows (sourcetype=WinEventLog:System OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational) EventCode=3
    | eval process=lower(Image)
    | where match(process, "\.sys$") OR DestinationPort IN ("1080","8080","8443","3128")
    | stats count, values(DestinationIp) as remote_ips, values(DestinationPort) as remote_ports by Image
    | rename Image as ServiceName
]
| table _time, ComputerName, ServiceName, ServiceFileName, SHA256, cert_signer, remote_ips, remote_ports
| sort -_time

sequence by host.id with maxspan=30m
  [driver where event.action == "driver-load"
   and dll.code_signature.subject_name like~ "*Microsoft*"
   and dll.code_signature.trusted == true
   and not process.name in~ ("System", "smss.exe", "services.exe", "wininit.exe")]
  [network where event.type == "connection"
   and process.executable like~ "*.sys"
   and destination.port in (80, 443, 1080, 3128, 8080, 8443)
   and not destination.ip in ("127.0.0.1", "::1")]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip",
  "destinationip",
  "destinationport",
  "filename",
  "username",
  QIDNAME(qid) AS event_name,
  UTF8(payload) AS raw_event
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (qid IN (SELECT qid FROM QIDMap WHERE eventname LIKE '%Driver%Install%' OR eventname LIKE '%Service Install%')
     AND UTF8(payload) ILIKE '%.sys%'
     AND UTF8(payload) ILIKE '%microsoft%')
    OR
    ("destinationport" IN (1080, 3128, 8080, 8443)
     AND "filename" LIKE '%.sys')
  )
  AND LOGSOURCEGROUPNAME(logsourceid) NOT LIKE '%honeypot%'
LAST 24 HOURS
ORDER BY devicetime DESC

_sourceCategory=windows/security OR _sourceCategory=windows/sysmon
| where EventID in ("7045", "6") or EventType = "DriverLoad"
| parse regex field=_raw "(?<driver_path>[A-Za-z]:\\\\[^\"<>|?*]+\.sys)" nodrop
| parse regex field=_raw "(?i)(?:SignerName|SubjectName)=\"(?<cert_signer>[^\"]+)\"" nodrop
| where isNull(cert_signer) OR cert_signer matches "*Microsoft*" OR cert_signer matches "*Windows*"
| where !isNull(driver_path)
| timeslice 5m
| count by _timeslice, _sourceHost, driver_path, cert_signer, EventID
| join
  [
    _sourceCategory=windows/sysmon EventID=3
    | where DestinationPort in ("1080", "3128", "8080", "8443", "443")
    | parse field=_raw "Image=(?<initiating_process>[^\r\n]+)" nodrop
    | where initiating_process matches "*.sys"
    | timeslice 5m
    | count by _timeslice, _sourceHost, initiating_process, DestinationIp, DestinationPort
  ] on _timeslice, _sourceHost
| project _timeslice, _sourceHost, driver_path, cert_signer, initiating_process, DestinationIp, DestinationPort
| sort by _timeslice desc

rule CVE_2024_26234_proxy_driver_spoofing {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-26234 — malicious Microsoft-signed proxy driver loading and establishing outbound connections"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-26234"
    tactic = "TA0003"
    technique = "T1543.003"

  events:
    $driver_load.metadata.event_type = "PROCESS_LAUNCH"
    $driver_load.principal.process.file.full_path = /\.sys$/i
    $driver_load.target.file.signature.signer_name = /microsoft/i
    $driver_load.target.file.signature.trust_chain_error = false
    $driver_load.principal.hostname = $hostname

    $network_conn.metadata.event_type = "NETWORK_CONNECTION"
    $network_conn.principal.process.file.full_path = /\.sys$/i
    $network_conn.target.port in (80, 443, 1080, 3128, 8080, 8443)
    $network_conn.principal.hostname = $hostname

  match:
    $hostname over 30m

  condition:
    $driver_load and $network_conn
}

#event_simpleName=DriverLoad
| DriverLoadFlags != "0x00000004"
| ImageFileName = /\.sys$/i
| ImageSignerName = /microsoft/i
| ImageSigningLevel in (4, 6, 8, 12)
| join type=inner (
    #event_simpleName=NetworkConnectIP4
    | RemotePort in [80, 443, 1080, 3128, 8080, 8443]
    | ImageFileName = /\.sys$/i
    | not RemoteAddressIP4 in ["127.0.0.1", "0:0:0:0:0:0:0:1"]
    | table aid, ImageFileName, RemoteAddressIP4, RemotePort
  ) by aid, ImageFileName
| table _time, aid, ComputerName, ImageFileName, ImageSignerName, RemoteAddressIP4, RemotePort
| sort -_time