Windows Anitivirus and EDR Elevation of Privilege Vulnerability

Description

The query for malicious file creations via TOCTOU Vulnerability in Leading Endpoint Detection and Response (EDR) and Antivirus (AV) Solutions. - Microsoft Defender (CVE-2022-37971) - Defender for Endpoint (CVE-2022-37971) - SentinelOne EDR - TrendMicro Apex One (CVE-2022-45797) - Avast Antivirus (CVE-2022-4173) - AVG Antivirus (CVE-2022-4173)

Query · kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName endswith "ndis.sys"
| where FolderPath startswith "C:\\temp\\Windows\\System32\\drivers\\"
Raw source Windows Anitivirus and EDR Elevation of Privilege Vulnerability · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a9eb9b06-4345-47f2-abe6-29f7200ddf83
name: Windows Anitivirus and EDR Elevation of Privilege Vulnerability
description: |
  The query for malicious file creations via TOCTOU Vulnerability in Leading Endpoint Detection and Response (EDR) and Antivirus (AV) Solutions.
  - Microsoft Defender (CVE-2022-37971)
  - Defender for Endpoint (CVE-2022-37971)
  - SentinelOne EDR
  - TrendMicro Apex One (CVE-2022-45797)
  - Avast Antivirus (CVE-2022-4173)
  - AVG Antivirus (CVE-2022-4173)
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- PrivilegeEscalation
- LateralMovement
relevantTechniques:
- t1574
query: |
  DeviceFileEvents
  | where Timestamp > ago(7d)
  | where ActionType == "FileCreated"
  | where FileName endswith "ndis.sys"
  | where FolderPath startswith "C:\\temp\\Windows\\System32\\drivers\\"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.