// ============================================================
// CVE-2026-21510 - Windows Shell Security Feature Bypass
// ============================================================
// --- Configuration ---
let LookbackPeriod      = 7d;
let NetworkSpawnWindow    = 2m;
let InternalIPRange       = "147.86.0.0/16";
let ExcludedCLIPatterns = dynamic([
    @"C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\",
    @"C:\Program Files (x86)\Citavi 6\Pickers\Chrome\ChromePickerBroker.exe",
    @"C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection"
]);
let ExcludedFolderPaths = dynamic([
    @"C:\Users\Public\Desktop",
    @"C:\ProgramData\Microsoft\Windows\Start Menu",
    @"C:\Windows\System32",
    @"C:\Program Files",
    @"C:\Program Files (x86)",
    @"C:\Windows\WinSxS"
]);
// --- Vulnerable Devices from TVM ---
let VulnerableDevices = DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-21510"
| distinct DeviceName;
let TvmContext = DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-21510"
| project DeviceName, OSPlatform, OSVersion, SoftwareName, SoftwareVersion, 
          VulnerabilitySeverityLevel, RecommendedSecurityUpdate;
// Detection 1: Suspicious LNK/URL/SCF Shell Execution
let LnkExecution = DeviceProcessEvents
| where Timestamp > ago(LookbackPeriod)
| where DeviceName in (VulnerableDevices)
| where InitiatingProcessFileName in~ ("explorer.exe","cmd.exe","powershell.exe","wscript.exe","mshta.exe")
| where ProcessCommandLine has_any (".lnk",".url",".scf") or InitiatingProcessCommandLine has_any (".lnk",".url",".scf")
| where not(FolderPath has_any (ExcludedFolderPaths))
| extend RiskLevel = case(
    ProcessCommandLine has_any ("powershell","cmd","wscript","cscript") and FolderPath has_any ("Temp","Downloads"), "High - Script from user directory",
    ProcessCommandLine has_any ("powershell","cmd","wscript","cscript"), "Medium - Shell script via link",
    FolderPath has_any ("Temp","Downloads"), "Medium - Link from user directory",
    "Low"
  )
| where RiskLevel != "Low"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, CommandLine = ProcessCommandLine, FolderPath, DetectionSource = "LNK/Shell Execution", RiskLevel, RemoteIP = "";
// Detection 2: MotW / SmartScreen Bypass
let MotWBypass = DeviceFileEvents
| where Timestamp > ago(LookbackPeriod)
| where DeviceName in (VulnerableDevices)
| where FileName endswith ".lnk" or FileName endswith ".url"
| where (isnotempty(FileOriginUrl) and FileOriginUrl startswith "http") or AdditionalFields has "ZoneId=3"
| where InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe","outlook.exe","winmail.exe")
| project DeviceName, DownloadTime = Timestamp, FileName, FileOriginUrl, BrowserProcessId = InitiatingProcessId
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(LookbackPeriod)
    | where DeviceName in (VulnerableDevices)
    | where FileName in~ ("wscript.exe","cscript.exe","powershell.exe","mshta.exe","rundll32.exe")
    | project DeviceName, AccountName, SpawnTime = Timestamp, CommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName, ParentProcessId = InitiatingProcessId
) on DeviceName, $left.BrowserProcessId == $right.ParentProcessId
| project Timestamp = SpawnTime, DeviceName, AccountName, InitiatingProcessFileName = ParentProcess, CommandLine, FolderPath = "", DetectionSource = "MotW/SmartScreen Bypass", RiskLevel = "High - Download + script-like child process", RemoteIP = "";
// Detection 3: Network-based Exploitation
let NetworkExploitation = DeviceNetworkEvents
| where Timestamp > ago(LookbackPeriod)
| where DeviceName in (VulnerableDevices)
| where InitiatingProcessFileName in~ ("wscript.exe","mshta.exe","cscript.exe")
| where RemotePort in (80, 443)
| where not(ipv4_is_in_range(RemoteIP, InternalIPRange))
| project DeviceName, NetTime = Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName, ScriptHostProcessId = InitiatingProcessId
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(LookbackPeriod)
    | where DeviceName in (VulnerableDevices)
    | where FileName in~ ("powershell.exe","cmd.exe","rundll32.exe","regsvr32.exe", "msiexec.exe","wmic.exe","certutil.exe")
    | project DeviceName, AccountName, SpawnTime = Timestamp, CommandLine = ProcessCommandLine, FolderPath, ParentProcessId = InitiatingProcessId
) on DeviceName, $left.ScriptHostProcessId == $right.ParentProcessId
| where SpawnTime between (NetTime .. NetTime + NetworkSpawnWindow)
| project Timestamp = SpawnTime, DeviceName, AccountName, InitiatingProcessFileName, CommandLine, FolderPath, DetectionSource = "Network Exploitation", RiskLevel = "High - Shell spawned child after external network activity", RemoteIP;
// --- Final Union and Enrichment ---
LnkExecution
| union MotWBypass
| union NetworkExploitation
| where not(CommandLine has_any (ExcludedCLIPatterns))
| join kind=leftouter TvmContext on DeviceName
| join kind=leftouter (
    DeviceInfo
    | summarize DeviceLastSeen = max(Timestamp) by DeviceName
) on DeviceName
| summarize 
    FirstSeen = min(Timestamp),
    LastSeen_Event = max(Timestamp),
    HitCount = count(),
    AffectedAccounts = make_set(AccountName, 10),
    DetectionSources = make_set(DetectionSource, 5),
    RemoteNetworkAddresses = make_set(RemoteIP, 10)
    by DeviceName, CommandLine, RiskLevel, InitiatingProcessFileName, FolderPath, OSPlatform, OSVersion, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, DeviceLastSeen
| sort by VulnerabilitySeverityLevel asc, HitCount desc, FirstSeen desc