CVE-2021-36934 usage detection

Description

Assuming that you have a machine that is properly BitLocker'ed, then the machine will need to be running to extract the SAM and SYSTEM files. This first query looks for any access to the HKLM that happens via a command or script that is not executed by system. The second query looks for usage of reg or regedit by anyone who is not system.

Query · kql

let startTime = now(-7d);
let endTime = now();
DeviceProcessEvents
| where Timestamp between (startTime..endTime)
| where ProcessCommandLine contains "HKLM"
| where AccountName != "system"
Raw source CVE-2021-36934 usage detection · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ab0afd3c-47fc-4a82-83ad-5c92528bdf08
name: CVE-2021-36934 usage detection
description: |
  Assuming that you have a machine that is properly BitLocker'ed, then
  the machine will need to be running to extract the SAM and SYSTEM
  files.
  This first query looks for any access to the HKLM that happens via a command
  or script that is not executed by system.
  The second query looks for usage of reg or regedit by anyone who is not system.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Privilege escalation
- Exploit
query: |
  let startTime = now(-7d);
  let endTime = now();
  DeviceProcessEvents
  | where Timestamp between (startTime..endTime)
  | where ProcessCommandLine contains "HKLM"
  | where AccountName != "system"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.