Detection rules › Kusto Query Language

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863

Source: upstream

'This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity.'

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.
Defender-DeviceProcessEvents	9001000	Process activity (any)

Stages and Predicates

Stage 1: `source`

<union>

Stage 2: `union`

union of 3 branches

Stage 3: `where`

and
  or
    InitiatingProcessCommandLine match ".webp"
    ProcessCommandLine match ".webp"
  DeviceId eq "VulnDevices"

Stage 4: `extend`

Stage 5: `extend`

Stage 6: `extend`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`DeviceId`	in	`VulnDevices`
`InitiatingProcessCommandLine`	match	`.webp`
`ProcessCommandLine`	match	`.webp`

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: source

Stage 2: union

Stage 3: where

Stage 4: extend

Stage 5: extend