Windows Image Load: Suspicious ksproxy.ax Loading Suggesting CVE-2024-35250
Flags Windows module loads of ksproxy.ax, a potential indicator of CVE-2024-35250 exploitation attempt activity.
- Product
- windows
- Category
- image_load
- Author
- @eyezuhk Isaac Fernandes (SigmaHQ), DRL 1.1
- Published
- 2025-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process image-load events where the loaded module ends with "\ksproxy.ax" outside common main-system directories and excluding several known user application binaries. Attackers may use such module loading behavior as part of exploitation or privilege-escalation attempts, so alerting on unexpected module paths helps surface suspicious activity. The detection relies on telemetry that records the ImageLoaded module name and the fully qualified Image path for the loading process.
Reporting behind it
- thehackernews.comhttps://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
- github.comhttps://github.com/varwara/CVE-2024-35250
- devco.rehttps://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
- cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-35250/image_load_exploit_cve_2024_35250_privilege_escalation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Image Load: Suspicious ksproxy.ax Loading Suggesting CVE-2024-35250"
id: a31f9f95-4e00-4eb0-b233-b430619cf9ca
status: experimental
description: This rule flags Windows process image-load events where the loaded module ends with "\ksproxy.ax" outside common main-system directories and excluding several known user application binaries. Attackers may use such module loading behavior as part of exploitation or privilege-escalation attempts, so alerting on unexpected module paths helps surface suspicious activity. The detection relies on telemetry that records the ImageLoaded module name and the fully qualified Image path for the loading process.
references:
- https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
- https://github.com/varwara/CVE-2024-35250
- https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-35250/image_load_exploit_cve_2024_35250_privilege_escalation.yml
author: "@eyezuhk Isaac Fernandes, Huntrule Team"
date: 2025-02-19
tags:
- attack.privilege-escalation
- attack.t1068
- cve.2024-35250
- detection.emerging-threats
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \ksproxy.ax
filter_main_system_paths:
Image|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
- C:\Windows\System32\
- C:\Windows\SysWOW64\
filter_optional_teams:
Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe
filter_optional_zoom:
Image|endswith: \AppData\Roaming\Zoom\bin\Zoom.exe
filter_optional_firefox:
Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe
filter_optional_chrome:
Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe
filter_optional_opera:
Image|endswith: \AppData\Local\Programs\Opera\opera.exe
filter_optional_discord:
Image|endswith: \AppData\Local\Discord\app-*\Discord.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate applications that use Windows Stream Interface APIs.
- Media applications that use DirectShow filters.
level: medium
license: DRL-1.1
related:
- id: 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
type: derived