ASUS Live Update Embedded Malicious Code (CVE-2025-59374)

let AsusUpdateProcs = dynamic(['LivaUpdate.exe', 'LiveUpdate.exe', 'ASUS Live Update.exe', 'AsusLiveUpdate.exe']);
let SuspiciousChildProcs = dynamic(['cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'certutil.exe', 'bitsadmin.exe', 'wmic.exe', 'net.exe', 'net1.exe', 'schtasks.exe', 'at.exe', 'sc.exe']);
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ (AsusUpdateProcs)
   or FileName in~ (AsusUpdateProcs)
| where FileName in~ (SuspiciousChildProcs)
   or (InitiatingProcessFileName in~ (AsusUpdateProcs) and not(FileName in~ (AsusUpdateProcs)))
| project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256
| union (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(30d)
    | where InitiatingProcessFileName in~ (AsusUpdateProcs)
    | where RemotePort in (80, 443, 4444, 8080, 8443, 1337)
    | project TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, LocalIP
)
| order by TimeGenerated desc

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Microsoft-Windows-Sysmon/Operational", "crowdstrike:events:sensor")
(EventCode=1 OR event_simpleName=ProcessRollup2)
| eval parent=coalesce(ParentImage, parent_process_name)
| eval child=coalesce(Image, process_name)
| where match(parent, "(?i)(LiveUpdate|LivaUpdate|AsusLiveUpdate)")
| eval is_suspicious_child=if(match(child, "(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|schtasks\.exe|sc\.exe)"), 1, 0)
| eval is_network_conn=if(EventCode=3 OR event_simpleName="NetworkConnectIP4", 1, 0)
| search is_suspicious_child=1 OR is_network_conn=1
| table _time, host, user, parent, child, CommandLine, ParentCommandLine, DestinationIp, DestinationPort, Hashes
| sort - _time

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.parent.name : ("LiveUpdate.exe", "LivaUpdate.exe", "AsusLiveUpdate.exe")
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "schtasks.exe", "sc.exe")]
  [any where event.category : ("network", "file") and
    (
      (event.category == "network" and destination.port in (80, 443, 4444, 8080, 8443, 1337)) or
      (event.category == "file" and file.path : ("*\\Temp\\*", "*\\AppData\\Local\\Temp\\*", "*\\ProgramData\\*"))
    )]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, destinationport,
       "Process Name" AS process_name,
       "Parent Process Name" AS parent_process_name,
       username, QIDNAME(qid) AS event_name,
       "Command" AS command_line
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (LOWER("Parent Process Name") LIKE '%liveupdate%' OR LOWER("Parent Process Name") LIKE '%asusliveupdate%')
    AND LOWER("Process Name") IN ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe',
                                   'rundll32.exe', 'regsvr32.exe', 'certutil.exe', 'bitsadmin.exe',
                                   'wmic.exe', 'schtasks.exe', 'sc.exe')
  )
LAST 7 DAYS
ORDER BY event_time DESC

_sourceCategory=windows/sysmon OR _sourceCategory=endpoint/process
| json field=_raw "EventID" as event_id nodrop
| json field=_raw "ParentImage" as parent_image nodrop
| json field=_raw "Image" as child_image nodrop
| json field=_raw "CommandLine" as command_line nodrop
| json field=_raw "User" as user nodrop
| where matches(parent_image, "(?i).*(LiveUpdate|LivaUpdate|AsusLiveUpdate).*")
| where matches(child_image, "(?i).*(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|schtasks\.exe|sc\.exe)")
| count by parent_image, child_image, command_line, user, _sourceHost
| sort by _count desc

rule asus_live_update_malicious_child_process {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects ASUS Live Update spawning suspicious child processes - CVE-2025-59374"
    severity = "CRITICAL"
    priority = "HIGH"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(LiveUpdate|LivaUpdate|AsusLiveUpdate)\.exe/
    $proc.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|schtasks|sc)\.exe/

  condition:
    $proc
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName IN ("LiveUpdate.exe", "LivaUpdate.exe", "AsusLiveUpdate.exe")
| search FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "schtasks.exe", "sc.exe")
| eval risk=if(match(CommandLine, "(?i)(invoke|iex|downloadstring|webclient|bypass|encoded|base64|hidden|frombase64)"), "HIGH", "MEDIUM")
| table _time, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, risk, SHA256HashData
| sort - _time