KQL Search

// Detect CVE-2024-43572 Abuse

// In Microsoft’s October security update, they highlighted that attackers are actively exploiting CVE-2024-43572, a remote code execution (RCE) flaw in the Microsoft Management Console (MMC). The patch released by Microsoft aims to prevent “untrusted Microsoft Saved Console (MSC) files from being opened,” thereby protecting customers from the associated risks.

// Security researchers at Elastic Security have observed threat actors using specially crafted MMC files, named GrimResource, for initial access and defense evasion. Although Microsoft did not address this specific point in their latest patch update, I took it upon myself to investigate the extent of this .msc vulnerability abuse using the SHA1 of GrimResource. To my astonishment, this .msc file has been detected in 260 organizations worldwide from June 26 to September 2. This significant number of affected organizations underscores the importance of Microsoft’s patch to block untrusted .msc files.

// While waiting for the October patch to be applied to all Windows servers and workstations, here’s an MDE KQL to detect unknown .msc files created on endpoints (excluding servers and admin endpoints where MMC is frequently run):

let CriticalIdentities =
ExposureGraphNodes
| where set_has_element(Categories, "identity")
| where isnotnull(NodeProperties.rawData.criticalityLevel) and
NodeProperties.rawData.criticalityLevel.criticalityLevel < 4 
| distinct NodeName;
let AdminDevices =
ExposureGraphEdges 
| where EdgeLabel == @"can authenticate to"
| join ExposureGraphNodes on $left.TargetNodeId==$right.NodeId
| extend DName = tostring(NodeProperties.rawData.deviceName)
| extend isLocalAdmin = EdgeProperties.rawData.userRightsOnDevice.isLocalAdmin
| where SourceNodeName has_any (CriticalIdentities)
| distinct DName;
let ServerDevice =
DeviceInfo 
| where OSPlatform contains "server"
| distinct DeviceName;
DeviceFileEvents
| where ActionType == @"FileCreated"
| where FileName endswith ".msc"
| where not (DeviceName has_any(AdminDevices))
| where not (DeviceName has_any (ServerDevice))

// MITRE ATT&CK Technique
// T1210 - Exploitation of Remote Services