Windows ImageLoad: Suspicious ksproxy.ax Loading Potential CVE-2024-35250 Activity

title: "Windows ImageLoad: Suspicious ksproxy.ax Loading Potential CVE-2024-35250 Activity"
id: a31f9f95-4e00-4eb0-b233-b430619cf9ca
status: experimental
description: This rule flags cases where Windows loads a module named "ksproxy.ax" from process image-load telemetry. Because attackers may use module loading to trigger or leverage vulnerable behavior, identifying this name helps surface potential exploitation attempts. It relies on Windows image load events (module load paths) and applies exclusions for common system and widely used application executable paths to reduce noise.
references:
  - https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
  - https://github.com/varwara/CVE-2024-35250
  - https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-35250/image_load_exploit_cve_2024_35250_privilege_escalation.yml
author: "@eyezuhk Isaac Fernandes, Huntrule Team"
date: 2025-02-19
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2024-35250
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \ksproxy.ax
  filter_main_system_paths:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  filter_optional_teams:
    Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe
  filter_optional_zoom:
    Image|endswith: \AppData\Roaming\Zoom\bin\Zoom.exe
  filter_optional_firefox:
    Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe
  filter_optional_chrome:
    Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe
  filter_optional_opera:
    Image|endswith: \AppData\Local\Programs\Opera\opera.exe
  filter_optional_discord:
    Image|endswith: \AppData\Local\Discord\app-*\Discord.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate applications that use Windows Stream Interface APIs.
  - Media applications that use DirectShow filters.
level: medium
license: DRL-1.1
related:
  - id: 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
    type: derived