CVE-2024-43468: Microsoft Configuration Manager SQL Injection Exploitation

let configmgr_ports = dynamic([80, 443, 8530, 8531, 10123]);
let sql_injection_patterns = dynamic(['UNION SELECT', 'OR 1=1', 'DROP TABLE', 'EXEC xp_', 'CAST(0x', 'WAITFOR DELAY', 'BENCHMARK(', "' OR '", "1=1--", 'xp_cmdshell']);
let timeframe = 1h;
union
(
  DeviceNetworkEvents
  | where TimeGenerated >= ago(timeframe)
  | where RemotePort in (configmgr_ports) or LocalPort in (configmgr_ports)
  | where DeviceName contains "SCCM" or DeviceName contains "ConfigMgr" or DeviceName contains "SMS"
  | project TimeGenerated, DeviceName, RemoteIP, RemotePort, LocalPort, InitiatingProcessFileName, ActionType
  | extend AlertType = "ConfigMgr Network Activity"
),
(
  DeviceProcessEvents
  | where TimeGenerated >= ago(timeframe)
  | where InitiatingProcessParentFileName in~ ("SMSvcHost.exe", "CcmExec.exe", "smsexec.exe")
  | where FileName in~ ("sqlcmd.exe", "osql.exe", "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
  | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
  | extend AlertType = "Suspicious Child Process from ConfigMgr"
),
(
  W3CIISLog
  | where TimeGenerated >= ago(timeframe)
  | where csUriStem contains "/SMS_" or csUriStem contains "/ccm_" or csUriStem contains "/AdminService"
  | where (
    csUriQuery has_any (sql_injection_patterns)
    or csUriStem has_any (sql_injection_patterns)
    or csMethod == "POST"
  )
  | where scStatus in (200, 500, 400)
  | project TimeGenerated, cIP, csMethod, csUriStem, csUriQuery, scStatus, scBytes, csUserAgent
  | extend AlertType = "Suspicious ConfigMgr HTTP Request"
),
(
  Event
  | where TimeGenerated >= ago(timeframe)
  | where Source == "MSSQLSERVER" or Source == "MSSQL$MICROSOFT##SS"
  | where EventID in (18456, 17882, 8601, 1205)
  | extend AlertType = "SQL Server Error - Potential Injection"
  | project TimeGenerated, Source, EventID, RenderedDescription, Computer, AlertType
)
| order by TimeGenerated desc

index=* sourcetype IN ("iis", "WinEventLog:Application", "WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval is_configmgr_iis=if(match(cs_uri_stem, "(?i)/SMS_|/ccm_|/AdminService|/ConfigMgr"), 1, 0)
| eval sql_inject_hit=if(match(cs_uri_query, "(?i)UNION\\s+SELECT|OR\\s+1\\s*=\\s*1|DROP\\s+TABLE|EXEC\\s+xp_|WAITFOR\\s+DELAY|xp_cmdshell|CAST\\(0x|BENCHMARK\\("), 1, 0)
| eval sccm_child_proc=if(match(ParentImage, "(?i)SMSvcHost\.exe|CcmExec\.exe|smsexec\.exe") AND match(Image, "(?i)sqlcmd\.exe|osql\.exe|cmd\.exe|powershell\.exe|wscript\.exe"), 1, 0)
| eval sql_error=if(sourcetype="WinEventLog:Application" AND (EventCode=18456 OR EventCode=17882 OR EventCode=8601) AND match(SourceName, "(?i)MSSQL"), 1, 0)
| where is_configmgr_iis=1 OR sql_inject_hit=1 OR sccm_child_proc=1 OR sql_error=1
| eval alert_type=case(
    sql_inject_hit=1, "SQL Injection Pattern in ConfigMgr Request",
    sccm_child_proc=1, "Suspicious Child Process from ConfigMgr Service",
    sql_error=1, "SQL Server Error Event - Potential Injection",
    true(), "Suspicious ConfigMgr HTTP Activity"
  )
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(cs_uri_stem) as uris values(Image) as child_processes values(CommandLine) as cmdlines by host alert_type
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
| table host alert_type count first_seen last_seen source_ips uris child_processes cmdlines

sequence by host.name with maxspan=5m
  [
    network where event.type == "connection" and
    (
      destination.port in (80, 443, 8530, 8531, 10123) or
      source.port in (80, 443, 8530, 8531, 10123)
    ) and
    (
      host.name like~ "*SCCM*" or
      host.name like~ "*ConfigMgr*" or
      host.name like~ "*SMS*"
    )
  ] by source.ip
  [
    process where event.type == "start" and
    process.parent.name in~ ("SMSvcHost.exe", "CcmExec.exe", "smsexec.exe") and
    process.name in~ ("sqlcmd.exe", "osql.exe", "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
  ] by host.ip
| filter true

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  QIDNAME(qid) AS event_name,
  logsourcename(logSourceId) AS log_source,
  "Message"
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (
      (URL ILIKE '%/SMS_%' OR URL ILIKE '%/ccm_%' OR URL ILIKE '%/AdminService%')
      AND (
        URL ILIKE '%UNION%SELECT%'
        OR URL ILIKE '%OR%1=1%'
        OR URL ILIKE '%xp_cmdshell%'
        OR URL ILIKE '%WAITFOR%DELAY%'
        OR URL ILIKE '%EXEC%xp_%'
        OR URL ILIKE '%DROP%TABLE%'
      )
    )
    OR
    (
      QIDNAME(qid) ILIKE '%process%create%'
      AND "Message" ILIKE '%SMSvcHost%'
      AND (
        "Message" ILIKE '%sqlcmd%'
        OR "Message" ILIKE '%cmd.exe%'
        OR "Message" ILIKE '%powershell%'
      )
    )
    OR
    (
      EventID IN (18456, 17882, 8601)
      AND LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log'
    )
  )
  AND LOGSOURCEGROUPNAME(logSourceGroupId) ILIKE '%Windows%'
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=*iis* OR _sourceCategory=*windows/event* OR _sourceCategory=*sysmon*
| where _sourceCategory matches "*iis*" or _sourceCategory matches "*windows*" or _sourceCategory matches "*sysmon*"
| parse regex "(?<uri_stem>/(?:SMS_|ccm_|AdminService)[^\\s\"']*)" nodrop
| parse regex "(?<sql_pattern>(?i)(?:UNION\\s+SELECT|OR\\s+1=1|xp_cmdshell|WAITFOR\\s+DELAY|DROP\\s+TABLE|EXEC\\s+xp_))" nodrop
| parse regex "(?<parent_proc>(?i)(?:SMSvcHost\.exe|CcmExec\.exe|smsexec\.exe))" nodrop
| parse regex "(?<child_proc>(?i)(?:sqlcmd\.exe|osql\.exe|cmd\.exe|powershell\.exe))" nodrop
| where (uri_stem != "" and sql_pattern != "") or (parent_proc != "" and child_proc != "") or (EventID in ("18456", "17882", "8601"))
| eval alert_type = if (!isEmpty(sql_pattern), "SQL Injection in ConfigMgr URI",
                    if (!isEmpty(child_proc) and !isEmpty(parent_proc), "Suspicious Child Process under SCCM",
                    "SQL Server Error Event"))
| stats count, first(_messageTime) as first_seen, last(_messageTime) as last_seen, values(src_ip) as source_ips, values(uri_stem) as uris by _sourceHost, alert_type
| sort by count desc

rule cve_2024_43468_configmgr_sqli {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-43468 exploitation - Microsoft Configuration Manager SQL Injection"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468"
    cve = "CVE-2024-43468"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP" and
      (
        re.regex($e1.target.url, `(?i)/SMS_|/ccm_|/AdminService`) and
        re.regex($e1.target.url, `(?i)UNION.{0,10}SELECT|OR.{0,5}1.{0,5}=.{0,5}1|xp_cmdshell|WAITFOR.{0,5}DELAY|DROP.{0,5}TABLE|EXEC.{0,5}xp_`)
      ) and
      $e1.target.port in (80, 443, 8530, 8531)
    ) or
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e1.principal.process.file.full_path, `(?i)SMSvcHost\.exe|CcmExec\.exe|smsexec\.exe`) and
      re.regex($e1.target.process.file.full_path, `(?i)sqlcmd\.exe|osql\.exe|cmd\.exe|powershell\.exe|wscript\.exe`)
    ) or
    (
      $e1.metadata.event_type = "GENERIC_EVENT" and
      $e1.metadata.product_name = "Microsoft-Windows-Security-Auditing" and
      $e1.metadata.product_event_type in ("18456", "17882", "8601")
    )

  condition:
    $e1
}

#event_simpleName IN (HttpRequest, ProcessRollup2, NetworkConnectIP4)
| $HttpRequest
  | filter (HttpPath LIKE "/SMS_*" OR HttpPath LIKE "/ccm_*" OR HttpPath LIKE "/AdminService*")
  | filter (HttpPath MATCHES "(?i)(UNION.{0,10}SELECT|OR.{0,5}1.{0,5}=.{0,5}1|xp_cmdshell|WAITFOR.{0,5}DELAY|DROP.{0,5}TABLE|EXEC.{0,5}xp_)")
  | select timestamp, HostnameField, RemoteAddressIP4, HttpMethod, HttpPath, HttpStatus
  | eval AlertType="SQL Injection in ConfigMgr URI"
| $ProcessRollup2
  | filter ParentBaseFileName IN~ ("SMSvcHost.exe", "CcmExec.exe", "smsexec.exe")
  | filter FileName IN~ ("sqlcmd.exe", "osql.exe", "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
  | select timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine
  | eval AlertType="Suspicious Child Process from ConfigMgr Service"
| union
| sort timestamp desc
| limit 500