Merge pull request #3417 from splunk/ZDI-CAN-25373

Clear and Present Haag-er: ZDI-CAN-25373

Author: patel-bhavin

detections/endpoint/windows_explorer_exe_spawning_powershell_or_cmd.yml

@@ -0,0 +1,35 @@
+name: Windows Explorer.exe Spawning PowerShell or Cmd
+id: 593854c5-2182-49dd-9f31-18ef697445b9
+version: 1
+date: '2025-03-24'
+author: Michael Haag, AJ King, Splunk, Jesse Hunter, Splunk Community Contributor
+status: production
+type: Hunting
+description: This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\explorer.exe" `process_powershell` OR `process_cmd`  by  Processes.dest Processes.process_current_directory Processes.process_path Processes.process Processes.original_file_name Processes.parent_process Processes.parent_process_name Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_explorer_exe_spawning_powershell_or_cmd_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Some legitimate user actions may trigger Explorer.exe to spawn PowerShell or cmd.exe, such as right-clicking and selecting "Open PowerShell window here" or similar options. Filter as needed based on your environment's normal behavior patterns.
+references:
+- https://www.zerodayinitiative.com/advisories/ZDI-CAN-25373/
+- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
+tags:
+  analytic_story:
+  - ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1059.001
+  - T1204.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/explorer_spawns_windows-sysmon.log
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml

@@ -0,0 +1,63 @@
+name: Windows Explorer LNK Exploit Process Launch With Padding
+id: 8775fcf3-05e4-4525-bba2-a56e39d8d050
+version: 1
+date: '2025-03-24'
+author: Michael Haag, AJ King, Splunk, Jesse Hunter, Splunk Community Contributor
+status: production
+type: TTP
+description: This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes with abnormally large padding (50 or more spaces) in the command line. This specific pattern is a key indicator of the ZDI-CAN-25373 Windows shortcut zero-day vulnerability exploitation, where threat actors craft malicious LNK files containing padded content to trigger code execution. The excessive spacing in the command line is used to manipulate the way Windows processes the shortcut file, enabling arbitrary code execution. This technique has been actively exploited by multiple APT groups in targeted attacks, with malicious LNK files being delivered through both HTTP and SMB protocols. The presence of significant command line padding when Explorer.exe launches command shells is highly suspicious and warrants immediate investigation.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+    where Processes.parent_process_path="*\\explorer.exe" 
+    (Processes.process_path="*\\cmd.exe" OR Processes.process_path="*\\powershell.exe")
+    by Processes.dest Processes.process_current_directory Processes.process_path Processes.process Processes.original_file_name Processes.parent_process Processes.parent_process_name Processes.parent_process_path 
+    Processes.parent_process_guid Processes.parent_process_id Processes.process_guid 
+    Processes.process_id Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | regex process=".*?\s{50,}.*"
+  | `windows_explorer_lnk_exploit_process_launch_with_padding_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Some legitimate user actions may trigger Explorer.exe to spawn PowerShell or cmd.exe, such as right-clicking and selecting "Open PowerShell window here" or similar options. Filter as needed based on your environment's normal behavior patterns. Reduce or increase the padding threshold based on observed false positives.
+references:
+- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Windows Explorer.exe spawning PowerShell or cmd.exe with excessive padding (50+ spaces) on $dest$ by $user$.
+  risk_objects:
+  - field: dest
+    type: system
+    score: 80
+  - field: user
+    type: user
+    score: 80
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+tags:
+  analytic_story:
+  - ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1059.001
+  - T1204.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/padded_windows-sysmon.log
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

detections/endpoint/windows_ssh_proxy_command.yml

@@ -0,0 +1,58 @@
+name: Windows SSH Proxy Command
+id: ac520039-21f1-4567-b528-5b7133dba76f
+version: 1
+date: '2025-03-24'
+author: Michael Haag, AJ King, Splunk, Jesse Hunter, Splunk Community Contributor
+status: production
+type: Anomaly
+description: This detection identifies potential abuse of SSH ProxyCommand by monitoring for suspicious process execution patterns. Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line. This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\ssh.exe" Processes.parent_process IN ("*ProxyCommand*") Processes.process IN ("*mshta*","*powershell*","*http*","*wscript*","*cscript*") by  Processes.dest  Processes.parent_process Processes.parent_process_path Processes.parent_process_name Processes.parent_process_guid Processes.process_path Processes.process Processes.original_file_name  Processes.parent_process_id Processes.process_guid Processes.process_current_directory Processes.process_id Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_ssh_proxy_command_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate use of SSH ProxyCommand with scripting engines may trigger this detection. Filter as needed based on your environment's normal SSH usage patterns and authorized scripting activities.
+references:
+- https://www.virustotal.com/gui/file/c33f82868dbbfc3ab03918f430b1a348499f5baf047b136ff0a4fc3e8addaa9b/detection
+- https://attack.mitre.org/techniques/T1572/
+drilldown_searches:
+- name: View the detection results for - "$user$" and "$dest$"
+  search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$" and "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Suspicious process execution detected through SSH ProxyCommand on $dest$ by user $user$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 60
+  - field: user
+    type: user
+    score: 40
+  threat_objects:
+  - field: parent_process_name
+    type: parent_process_name
+tags:
+  analytic_story:
+  - ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
+  - Living Off The Land
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1572
+  - T1059.001
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ssh_proxy_command/sshproxycommand_windows-sysmon.log
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

stories/zdi_can_25373_windows_shortcut_exploit_abused_as_zero_day.yml

@@ -0,0 +1,19 @@
+name: ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
+id: 41a6bda1-fdd4-479e-a685-25c838d26b6b
+version: 1
+status: production
+date: '2025-03-24'
+author: Michael Haag, AJ King, Splunk
+description: This story addresses a critical Windows shortcut zero-day vulnerability (ZDI-CAN-25373) that has been actively exploited in widespread APT campaigns. The vulnerability allows attackers to execute malicious code through specially crafted LNK files, which can be delivered via both HTTP and SMB protocols. This exploit has been observed being used by multiple threat actors in targeted attacks.
+narrative: The Windows shortcut zero-day vulnerability (ZDI-CAN-25373) represents a significant security threat that has been actively exploited in the wild. The exploit involves specially crafted LNK files that contain padded content designed to trigger code execution. These malicious shortcuts can be delivered through both HTTP and SMB protocols, making them particularly versatile for attackers. Multiple APT groups, including Water Glashtyn, Earth Iktomi, Water Poukai, and others, have been observed leveraging this vulnerability in their campaigns. The attack typically involves suspicious cmd.exe, ssh.exe or powershell.exe execution from LNK files, which can be detected through specific process execution patterns. This vulnerability poses a serious risk to Windows systems and requires immediate attention for detection and mitigation.
+references: 
+- https://www.zerodayinitiative.com/advisories/ZDI-25-373/
+- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
+tags:
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection