Windows File Explorer Elevation Of Privilege Vulnerability CVE 2024 38100 Exploited
Query
DeviceProcessEvents
| where ProcessCommandLine contains "9BA05972-F6A8-11CF-A442-00A0C90A8F39"
| join kind=inner ( DeviceInfo) on $left.DeviceId == $right.DeviceId
| where (OSDistribution has "WindowsServer2016" and OSBuild < 14393) or (OSDistribution has "WindowsServer2019" and OSBuild < 17763)
or (OSDistribution has "WindowsServer2022" and OSVersionInfo !contains "23H2" and OSBuild < 20348) or (OSDistribution has "WindowsServer2022" and OSVersionInfo contains "23H2" and OSBuild < 25398)
| distinct OSVersion,OSArchitecture, OSVersionInfo, OSDistribution, OSBuild ,ProcessCommandLineAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1068 | Exploitation for Privilege Escalation |
Author: Sergio Albea (30/01/2025)
Windows File Explorer Elevation Of Privilege Vulnerability(CVE-2024-38100) Exploited
This KQL query helps to identify a Windows vulnerability which resides in the ShellWindows DCOM object within the Windows File Explorer process, allowing attackers to exploit improper access controls when File Explorer runs at a High Integrity Level. By leveraging COM Cross-Session Activation (Specifically, the ShellWindows DCOM object '9BA05972-F6A8-11CF-A442-00A0C90A8F39'), attackers can escalate privileges to execute arbitrary commands or launch reverse shells using methods like ShellExecute. With a CVSS score of 7.8 (High), exploitation can lead to unauthorized access to sensitive files, installation of malware, or full system compromise. The attack has low complexity, requires local access, and became more dangerous after a proof-of-concept was publicly disclosed in July 2024.
Explanation
This KQL query is designed to detect a specific security vulnerability in Windows systems, identified as CVE-2024-38100. The vulnerability is related to the Windows File Explorer process, where attackers can exploit a component called the ShellWindows DCOM object to gain higher privileges on the system. This can allow them to execute unauthorized commands or launch reverse shells, potentially leading to serious security breaches such as unauthorized access to sensitive data or full system compromise.
The query works by:
- Searching for processes that have executed commands containing the specific identifier "9BA05972-F6A8-11CF-A442-00A0C90A8F39", which is associated with the vulnerable ShellWindows DCOM object.
- Joining this data with device information to ensure the query is looking at the correct devices.
- Filtering the results to focus on specific versions of Windows Server (2016, 2019, and 2022) that are known to be vulnerable based on their build numbers.
- Returning distinct information about the operating system version, architecture, and build, along with the command line that was executed.
In summary, this query helps security teams identify systems that might be vulnerable to this specific privilege escalation exploit, allowing them to take corrective actions to protect their networks.
