CVE-2024-38112 - Windows MSHTML Spoofing via .url File Phishing (Void Banshee)

let suspiciousUriHandlers = dynamic(['mhtml:', 'ms-its:', 'its:', 'mk:@MSITStore']);
let suspiciousParents = dynamic(['explorer.exe', 'outlook.exe', 'winword.exe', 'excel.exe', 'powerpnt.exe', 'msedge.exe', 'chrome.exe', 'firefox.exe']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where FileName =~ 'iexplore.exe' or FileName =~ 'exthost.exe'
| where InitiatingProcessFileName has_any (suspiciousParents)
| extend CommandLineLower = tolower(ProcessCommandLine)
| where CommandLineLower has_any (suspiciousUriHandlers)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| union (
    DeviceFileEvents
    | where TimeGenerated >= ago(7d)
    | where FileName endswith '.url'
    | where InitiatingProcessFileName has_any ('outlook.exe', 'winword.exe', 'excel.exe', 'powerpnt.exe', 'msedge.exe', 'chrome.exe', 'firefox.exe')
    | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName
)
| order by TimeGenerated desc

index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval CommandLineLower=lower(CommandLine)
| search (Image="*\\iexplore.exe" AND (CommandLineLower="*mhtml:*" OR CommandLineLower="*ms-its:*" OR CommandLineLower="*mk:@msitstore*" OR CommandLineLower="*its:*"))
    AND (ParentImage="*\\explorer.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\msedge.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\firefox.exe")
| eval risk_score=case(
    like(CommandLineLower,"%mhtml:http%"), 95,
    like(CommandLineLower,"%ms-its:%"), 90,
    like(CommandLineLower,"%mk:@msitstore%"), 85,
    true(), 70
  )
| table _time, host, user, Image, CommandLine, ParentImage, ParentCommandLine, risk_score
| sort -_time

sequence by host.name with maxspan=30s
  [file where event.action == "creation" and file.extension == "url"
   and process.name : ("outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "msedge.exe", "chrome.exe", "firefox.exe")]
  [process where event.action == "start" and process.name == "iexplore.exe"
   and process.command_line : ("*mhtml:*", "*ms-its:*", "*mk:@MSITStore*", "*its:*")
   and process.parent.name : ("explorer.exe", "outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "msedge.exe", "chrome.exe", "firefox.exe")]

SELECT DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS 'Event Time',
       sourceip AS 'Source IP',
       username AS 'User',
       "Process Name" AS 'Process',
       "Command" AS 'Command Line',
       "Parent Process Name" AS 'Parent Process',
       QIDNAME(qid) AS 'Event Name',
       logsourcename(logsourceid) AS 'Log Source'
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND LOWER("Process Name") LIKE '%iexplore.exe%'
  AND (
       LOWER("Command") LIKE '%mhtml:%'
    OR LOWER("Command") LIKE '%ms-its:%'
    OR LOWER("Command") LIKE '%mk:@msitstore%'
    OR LOWER("Command") LIKE '%its:%'
  )
  AND LOWER("Parent Process Name") IN ('explorer.exe','outlook.exe','winword.exe','excel.exe','powerpnt.exe','msedge.exe','chrome.exe','firefox.exe')
  AND DATEFORMAT(devicetime,'yyyy-MM-dd') >= DATEADD('day',-7,CURRENT_DATE)
ORDER BY devicetime DESC
LIMIT 1000

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json auto
| where (Image matches "*\\iexplore.exe" or process_name matches "*iexplore.exe")
| where (
    toLowerCase(CommandLine) matches "*mhtml:*" or
    toLowerCase(CommandLine) matches "*ms-its:*" or
    toLowerCase(CommandLine) matches "*mk:@msitstore*" or
    toLowerCase(CommandLine) matches "*its:*"
  )
| where (
    toLowerCase(ParentImage) matches "*outlook.exe*" or
    toLowerCase(ParentImage) matches "*winword.exe*" or
    toLowerCase(ParentImage) matches "*excel.exe*" or
    toLowerCase(ParentImage) matches "*powerpnt.exe*" or
    toLowerCase(ParentImage) matches "*explorer.exe*" or
    toLowerCase(ParentImage) matches "*msedge.exe*" or
    toLowerCase(ParentImage) matches "*chrome.exe*" or
    toLowerCase(ParentImage) matches "*firefox.exe*"
  )
| count by _sourceHost, User, CommandLine, ParentImage
| sort by _count desc

rule cve_2024_38112_mshtml_url_spoofing {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2024-38112 exploitation: iexplore.exe launched with mhtml/ms-its URI handlers from document or browser parents"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)iexplore\.exe$/
    (
      $proc.target.process.command_line = /(?i)mhtml:/ or
      $proc.target.process.command_line = /(?i)ms-its:/ or
      $proc.target.process.command_line = /(?i)mk:@MSITStore/ or
      $proc.target.process.command_line = /(?i)its:\/\//
    )
    (
      $proc.principal.process.file.full_path = /(?i)(outlook|winword|excel|powerpnt|explorer|msedge|chrome|firefox)\.exe$/
    )

  condition:
    $proc
}

event_simpleName=ProcessRollup2
| search ImageFileName=~"*\\iexplore.exe"
    AND (CommandLine=~"*mhtml:*" OR CommandLine=~"*ms-its:*" OR CommandLine=~"*mk:@MSITStore*" OR CommandLine=~"*its://*")
    AND ParentBaseFileName IN ("outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "explorer.exe", "msedge.exe", "chrome.exe", "firefox.exe")
| eval uri_type=case(
    match(CommandLine, "(?i)mhtml:"), "mhtml",
    match(CommandLine, "(?i)ms-its:"), "ms-its",
    match(CommandLine, "(?i)mk:@MSITStore"), "mk-msitstore",
    true(), "other-legacy"
  )
| table _time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, uri_type
| sort -_time