CVE-2025-62221 Microsoft Windows Use After Free Exploitation

let timeframe = 24h;
let suspiciousProcesses = dynamic(["lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe"]);
union
(
    SecurityEvent
    | where TimeGenerated >= ago(timeframe)
    | where EventID in (4688, 4689)
    | where NewProcessName has_any ("exploit", "shellcode") or
            (ParentProcessName in~ (suspiciousProcesses) and NewProcessName !in~ (suspiciousProcesses))
    | project TimeGenerated, Computer, Account, NewProcessName, ParentProcessName, CommandLine, EventID
),
(
    DeviceEvents
    | where TimeGenerated >= ago(timeframe)
    | where ActionType in ("ExploitGuardNetworkProtectionAudited", "ExploitGuardNetworkProtectionBlocked", "MemoryAllocationViolation", "UnexpectedKernelWriteAttempt")
    | project TimeGenerated, DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields
),
(
    DeviceProcessEvents
    | where TimeGenerated >= ago(timeframe)
    | where InitiatingProcessIntegrityLevel == "High" and AccountName != "SYSTEM"
    | where ProcessVersionInfoOriginalFileName in~ (suspiciousProcesses) or
            (InitiatingProcessParentFileName in~ (suspiciousProcesses) and InitiatingProcessFileName !in~ (suspiciousProcesses))
    | project TimeGenerated, DeviceName, AccountName, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| extend CVE = "CVE-2025-62221"
| sort by TimeGenerated desc

index=windows (sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=crowdstrike:events:sensor)
| eval timeframe=relative_time(now(), "-24h")
| where _time >= timeframe
| eval is_system_proc=if(match(lower(Image), "(lsass|csrss|winlogon|services|svchost)\.exe$"), 1, 0)
| eval is_parent_system=if(match(lower(ParentImage), "(lsass|csrss|winlogon|services|svchost)\.exe$"), 1, 0)
| eval uaf_indicator=case(
    (EventCode=4688 AND is_parent_system=1 AND is_system_proc=0), "anomalous_child_from_system_parent",
    (EventCode=1 AND IntegrityLevel="High" AND is_parent_system=1 AND is_system_proc=0), "elevated_child_from_system_parent",
    match(lower(CommandLine), "(exploit|shellcode|heap.spray|rop.chain)"), "exploit_keyword_in_cmdline",
    match(lower(Image), "(exploit|shellcode)"), "suspicious_image_name",
    1=1, null()
  )
| where isnotnull(uaf_indicator)
| stats count min(_time) as first_seen max(_time) as last_seen values(uaf_indicator) as indicators values(CommandLine) as commands by host, user, Image, ParentImage
| eval cve="CVE-2025-62221"
| sort - count

sequence by host.name with maxspan=5m
  [process where event.action == "start" and
   process.parent.name in ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe") and
   not process.name in ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe",
                        "conhost.exe", "WerFault.exe", "wermgr.exe")]
  [any where event.category == "process" and
   (process.token.integrity_level_name == "high" or process.token.integrity_level_name == "system") and
   user.name != "SYSTEM" and user.name != "LOCAL SERVICE" and user.name != "NETWORK SERVICE"]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  "ParentProcessName",
  "ProcessName",
  "CommandLine",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Sysmon')
  AND devicetime > (CURRENT_TIMESTAMP - 86400000)
  AND (
    (
      "ParentProcessName" ILIKE '%lsass.exe'
      OR "ParentProcessName" ILIKE '%csrss.exe'
      OR "ParentProcessName" ILIKE '%winlogon.exe'
      OR "ParentProcessName" ILIKE '%services.exe'
    )
    AND "ProcessName" NOT ILIKE '%lsass.exe'
    AND "ProcessName" NOT ILIKE '%csrss.exe'
    AND "ProcessName" NOT ILIKE '%winlogon.exe'
    AND "ProcessName" NOT ILIKE '%conhost.exe'
    AND "ProcessName" NOT ILIKE '%WerFault.exe'
  )
ORDER BY devicetime DESC
LIMIT 1000

_sourceCategory=windows* OR _sourceCategory=sysmon*
| json auto
| where _sourceCategory matches /windows|sysmon/
| parse "EventID=*" as event_id nodrop
| parse "Image=*" as process_image nodrop
| parse "ParentImage=*" as parent_image nodrop
| parse "CommandLine=*" as command_line nodrop
| parse "User=*" as user nodrop
| where event_id in ("4688", "1")
| where (
    (parent_image matches /*(lsass|csrss|winlogon|services|svchost)\.exe/)
    AND NOT (process_image matches /*(lsass|csrss|winlogon|conhost|WerFault|wermgr)\.exe/)
  )
  OR (command_line matches /(?i)(exploit|shellcode|heap.spray)/)
| count by _sourceHost, user, process_image, parent_image, command_line
| sort by _count desc

rule cve_2025_62221_windows_uaf_exploitation {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-62221 Windows use-after-free exploitation via anomalous process ancestry"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62221"
    cve = "CVE-2025-62221"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /(?i)\\(lsass|csrss|winlogon|services|svchost)\.exe$/
    not $e.target.process.file.full_path = /(?i)\\(lsass|csrss|winlogon|services|svchost|conhost|WerFault|wermgr)\.exe$/
    $e.target.process.integrity_level_name = "HIGH" or $e.target.process.integrity_level_name = "SYSTEM"
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe")
| ImageFileName not in ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe", "conhost.exe", "WerFault.exe", "wermgr.exe")
| TokenIsElevated = "1"
| table _time, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, IntegrityLevel, TokenIsElevated
| eval cve = "CVE-2025-62221"
| sort - _time
| limit 500