detect-exploitation-of-cve-2018-8653

id: 1f541cc3-2c46-4f2a-9b4b-e082f25ec369
name: detect-exploitation-of-cve-2018-8653
description: |
  This query was originally published in the threat analytics report, CVE-2018-8653 scripting engine vulnerability.
  CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
  Microsoft has since addressed this vulnerability.
  The following queries detect possible exploitation of this CVE.
  References:
  https://nvd.nist.gov/vuln/detail/CVE-2018-8653
  https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Initial access
- Execution
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  and InitiatingProcessFileName =~ "svchost.exe"
  and InitiatingProcessCommandLine contains "WinHttpAutoProxySvc"
  and FileName !~ "pacjsworker.exe"
  and FileName !~ "svchost.exe"
  and FileName !~ "WerFault.exe"