Flash-CVE-2018-4848

id: 8e32bc35-72e6-4bc9-b3bb-2ee346c8acf0
name: Flash-CVE-2018-4848
description: |
  This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT.
  CVE: CVE-2018-4878.
  Read more here:.
  Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
  Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
  Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
  Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
  Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
  DeviceNetworkEvents 
  | where Timestamp > ago(14d) 
  | where InitiatingProcessFileName =~ "cmd.exe" and InitiatingProcessParentFileName =~ "excel.exe" 
  | where RemoteUrl endswith ".kr" 
  | project Timestamp, DeviceName, RemoteIP, RemoteUrl  
  | top 100 by Timestamp