KQL Search

**Windows File Explorer Elevation Of Privilege Vulnerability(CVE-2024-38100) Exploited**

This KQL query helps to identify a Windows vulnerability which resides in the ShellWindows DCOM object within the Windows File Explorer process, allowing attackers to exploit improper access controls when File Explorer runs at a High Integrity Level. By leveraging COM Cross-Session Activation (Specifically, the ShellWindows DCOM object '9BA05972-F6A8-11CF-A442-00A0C90A8F39'), attackers can escalate privileges to execute arbitrary commands or launch reverse shells using methods like ShellExecute.
With a CVSS score of 7.8 (High), exploitation can lead to unauthorized access to sensitive files, installation of malware, or full system compromise. The attack has low complexity, requires local access, and became more dangerous after a proof-of-concept was publicly disclosed in July 2024.


```
DeviceProcessEvents
| where ProcessCommandLine contains "9BA05972-F6A8-11CF-A442-00A0C90A8F39"
| join kind=inner ( DeviceInfo) on $left.DeviceId == $right.DeviceId
| where (OSDistribution has "WindowsServer2016" and OSBuild < 14393) or (OSDistribution has "WindowsServer2019" and OSBuild < 17763)
 or (OSDistribution has "WindowsServer2022" and OSVersionInfo !contains "23H2" and OSBuild < 20348) or (OSDistribution has "WindowsServer2022" and OSVersionInfo contains "23H2" and OSBuild < 25398)
| distinct OSVersion,OSArchitecture, OSVersionInfo, OSDistribution, OSBuild ,ProcessCommandLine
```