cve20201350_dns_remote_code_exploit_sigred_via_cmdline

rule cve20201350_dns_remote_code_exploit_sigred_via_cmdline {
 meta:
    author = "SOC Prime Team"
    description = "Detects exploitation of CVE-2020-1350 (aka SIGRED) using suspicious child processes spawned by the exploitable Windows DNS process.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/kiaGjZKlbr51"
    version = "0.01"
    created = "2021-03-09"
    category = "process_creation"
    product = "windows"
    mitre = "privilege_escalation, execution, t1068, t1190"

  events:
(re.regex($dns_parent_process.principal.process.file.full_path, `.*\\System32\\dns\.exe`) and not ((re.regex($dns_parent_process.target.process.file.full_path, `.*werfault\.exe`) or re.regex($dns_parent_process.target.process.file.full_path, `.*conhost\.exe`))))

  condition:
    $dns_parent_process
}