Droppers exploiting CVE-2017-11882

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Rule Content

- title: Droppers exploiting CVE-2017-11882
  id: 678eb5f4-8597-4be6-8be7-905e4234b53a
  status: experimental
  description: Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and
    other sub processes like mshta.exe
  references:
  - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
  - https://www.google.com/url?hl=en&q=https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about&source=gmail&ust=1511481120837000&usg=AFQjCNGdL7gVwLXaNSl2Td8ylDYbSJFmPw
  author: Florian Roth
  date: 2017/11/23
  tags:
  - attack.defense_evasion
  - attack.t1211
  logsource:
    category: process_creation
    product: windows
    service: null
  detection:
    selection:
      ParentImage: '*\EQNEDT32.EXE'
    condition: selection
  fields:
  - CommandLine
  falsepositives:
  - unknown
  level: critical

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='process_parent_path.keyword:*\\EQNEDT32.EXE')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()