{"id":"48d91a3a-2363-43ba-a456-ca71ac3da5c2","title":"Audit CVE Event","description":"Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.\nMS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.\nUnfortunately, that is about the only instance of CVEs being written to this log.\n","author":"Florian Roth (Nextron Systems), Zach Mathis","status":"test","level":"critical","date":"2020-01-15","modified":"2022-10-22","tags":["attack.execution","attack.stealth","attack.t1203","attack.privilege-escalation","attack.t1068","attack.t1211","attack.credential-access","attack.t1212","attack.lateral-movement","attack.t1210","attack.impact","attack.t1499.004"],"technique_ids":["T1068","T1203","T1210","T1211","T1212","T1499.004"],"logsource":{"product":"windows","service":"application"},"falsepositives":["Unknown"],"references":["https://twitter.com/VM_vivisector/status/1217190929330655232","https://twitter.com/DidierStevens/status/1217533958096924676","https://twitter.com/FlemmingRiis/status/1217147415482060800","https://www.youtube.com/watch?v=ebmW42YYveI","https://nullsec.us/windows-event-log-audit-cve/"],"source_path":"rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml","source_sha256":"25d26904f1984a071814cdbf18eeb06658c086ceaf37ae059138138dc6c15e4d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Audit CVE Event\nid: 48d91a3a-2363-43ba-a456-ca71ac3da5c2\nstatus: test\ndescription: |\n    Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.\n    MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.\n    Unfortunately, that is about the only instance of CVEs being written to this log.\nreferences:\n    - https://twitter.com/VM_vivisector/status/1217190929330655232\n    - https://twitter.com/DidierStevens/status/1217533958096924676\n    - https://twitter.com/FlemmingRiis/status/1217147415482060800\n    - https://www.youtube.com/watch?v=ebmW42YYveI # \"CVEs in Windows Event Logs? What You Need to Know\" by 13Cubed.\n    - https://nullsec.us/windows-event-log-audit-cve/\nauthor: Florian Roth (Nextron Systems), Zach Mathis\ndate: 2020-01-15\nmodified: 2022-10-22\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1203\n    - attack.privilege-escalation\n    - attack.t1068\n    - attack.t1211\n    - attack.credential-access\n    - attack.t1212\n    - attack.lateral-movement\n    - attack.t1210\n    - attack.impact\n    - attack.t1499.004\nlogsource:\n    product: windows\n    service: application\ndetection:\n    selection:\n        Provider_Name:\n            - 'Microsoft-Windows-Audit-CVE'\n            - 'Audit-CVE'\n        EventID: 1\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"},{"key":"enterprise/T1210","id":"T1210","name":"Exploitation of Remote Services","page":"techniques/enterprise/T1210/"},{"key":"enterprise/T1211","id":"T1211","name":"Exploitation for Stealth","page":"techniques/enterprise/T1211/"},{"key":"enterprise/T1212","id":"T1212","name":"Exploitation for Credential Access","page":"techniques/enterprise/T1212/"},{"key":"enterprise/T1499.004","id":"T1499.004","name":"Application or System Exploitation","page":"techniques/enterprise/T1499.004/"}],"data_path":"data/detection-rules/48d91a3a-2363-43ba-a456-ca71ac3da5c2.json","kind":"sigma"}