Execution of software vulnerable to webp buffer overflow of CVE-2023-4863

Back


Id	26e81021-2de6-4442-a74a-a77885e96911
Rulename	Execution of software vulnerable to webp buffer overflow of CVE-2023-4863
Description	This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity.
Severity	Informational
Tactics	Execution
Techniques	T1203
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Defender XDR/Analytic Rules/PossibleWebpBufferOverflow.yaml
Version	1.1.2
Arm template	26e81021-2de6-4442-a74a-a77885e96911.json

KQL

//CVE-2023-4863 Process activity with .webp files on devices where CVE-2023-4863 is unpatched
//This query shows all process activity with .webp files on vulnerable machines and is not an indicator of malicious activity
let VulnDevices = DeviceTvmSoftwareVulnerabilities
    | where CveId == "CVE-2023-4863"
    | distinct DeviceId;
union DeviceProcessEvents, DeviceNetworkEvents, DeviceEvents
| where DeviceId in (VulnDevices) and (InitiatingProcessCommandLine has(".webp") or ProcessCommandLine has(".webp"))
| extend Name = tostring(split(AccountUpn, "@")[0]), UPNSuffix = tostring(split(AccountUpn, "@")[1])
| extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)

YAML

queryFrequency: 1h
relevantTechniques:
- T1203
id: 26e81021-2de6-4442-a74a-a77885e96911
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    matchingMethod: Selected
    groupByEntities:
    - Account
    groupByCustomDetails: []
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    groupByAlertDetails: []
version: 1.1.2
query: |-
  //CVE-2023-4863 Process activity with .webp files on devices where CVE-2023-4863 is unpatched
  //This query shows all process activity with .webp files on vulnerable machines and is not an indicator of malicious activity
  let VulnDevices = DeviceTvmSoftwareVulnerabilities
      | where CveId == "CVE-2023-4863"
      | distinct DeviceId;
  union DeviceProcessEvents, DeviceNetworkEvents, DeviceEvents
  | where DeviceId in (VulnDevices) and (InitiatingProcessCommandLine has(".webp") or ProcessCommandLine has(".webp"))
  | extend Name = tostring(split(AccountUpn, "@")[0]), UPNSuffix = tostring(split(AccountUpn, "@")[1])
  | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)  
tags:
- CVE-2023-4863
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
  - DeviceNetworkEvents
  - DeviceEvents
  - DeviceTvmSoftwareVulnerabilities
suppressionEnabled: false
triggerThreshold: 0
suppressionDuration: PT5H
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Execution of software vulnerable to webp buffer overflow of CVE-2023-4863
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Defender XDR/Analytic Rules/PossibleWebpBufferOverflow.yaml
kind: Scheduled
triggerOperator: gt
tactics:
- Execution
severity: Informational
description: |
    'This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity.'
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: DeviceName
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: HostNameDomain
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountUpn
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: LocalIP
- entityType: Process
  fieldMappings:
  - identifier: ProcessId
    columnName: ProcessId
- entityType: Process
  fieldMappings:
  - identifier: ProcessId
    columnName: InitiatingProcessId
- entityType: Process
  fieldMappings:
  - identifier: CommandLine
    columnName: ProcessCommandLine
queryPeriod: 1h
alertDetailsOverride:
  alertDisplayNameFormat: Possible exploitation of CVE-2023-4863
  alertDynamicProperties: []
status: Available

ARM