detect-cve-2019-1129-byebear-exploit

id: e9ff9991-7e5e-4bd4-8dea-e38db7e0027e
name: detect-cve-2019-1129-byebear-exploit
description: |
  This query was originally published in the threat analytics report, May 2019 0-day disclosures.
  In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
  Patches and more information about each vulnerability are available below:
  1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
  2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
  3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
  4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
  5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
  6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
  This query locates possible activity that exploits CVE-2019-1129 (also known as ByeBear or CVE-2019-0841-Bypass 2), the sixth vulnerability listed above.
  Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Privilege escalation
query: |
  //Find possible use of ByeBear (CVE-2019-1129)
  DeviceProcessEvents 
  | where ProcessCommandLine contains
  @"packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe"
  and ProcessCommandLine contains"/S /Q"
  and (ProcessCommandLine contains "rmdir" or ProcessCommandLine contains "del")