Windows Application Audit CVE (Microsoft-Windows-Audit-CVE) EventID 1 from CveEventWrite API

title: Windows Application Audit CVE (Microsoft-Windows-Audit-CVE) EventID 1 from CveEventWrite API
id: da21ed25-6bef-4545-8ef2-7dc073c17e7f
status: test
description: This rule flags application-generated Windows audit events when user-mode code records known CVE activity via the CveEventWrite API. Attackers may use vulnerability-driven behavior or tooling that triggers these audit records during attempted exploitation. It relies on Windows Application logs for the Microsoft-Windows-Audit-CVE provider with EventID 1 and provider name matching the audit CVE source entries.
references:
  - https://twitter.com/VM_vivisector/status/1217190929330655232
  - https://twitter.com/DidierStevens/status/1217533958096924676
  - https://twitter.com/FlemmingRiis/status/1217147415482060800
  - https://www.youtube.com/watch?v=ebmW42YYveI
  - https://nullsec.us/windows-event-log-audit-cve/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml
author: Florian Roth (Nextron Systems), Zach Mathis, Huntrule Team
date: 2020-01-15
modified: 2022-10-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1211
  - attack.credential-access
  - attack.t1212
  - attack.lateral-movement
  - attack.t1210
  - attack.impact
  - attack.t1499.004
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name:
      - Microsoft-Windows-Audit-CVE
      - Audit-CVE
    EventID: 1
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 48d91a3a-2363-43ba-a456-ca71ac3da5c2
    type: derived