Potential CVE-2024-35250 Exploitation Activity

title: Potential CVE-2024-35250 Exploitation Activity
id: 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
status: experimental
description: |
    Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
references:
    - https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
    - https://github.com/varwara/CVE-2024-35250
    - https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: '@eyezuhk Isaac Fernandes'
date: 2025-02-19
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2024-35250
    - detection.emerging-threats
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\ksproxy.ax'
    filter_main_system_paths:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_teams:
        Image|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
    filter_optional_zoom:
        Image|endswith: '\AppData\Roaming\Zoom\bin\Zoom.exe'
    filter_optional_firefox:
        Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
    filter_optional_chrome:
        Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
    filter_optional_opera:
        Image|endswith: '\AppData\Local\Programs\Opera\opera.exe'
    filter_optional_discord:
        Image|endswith: '\AppData\Local\Discord\app-*\Discord.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate applications that use Windows Stream Interface APIs.
    - Media applications that use DirectShow filters.
level: medium