topic Re: MS Crypto API Vuln - CVE-2020-0601 - Any example logs? in Getting Data In

MS Crypto API Vuln - CVE-2020-0601 - Any example logs?

dsctm3 — Wed, 15 Jan 2020 15:35:52 GMT

Hello Splunkers!

TL;DR - Has anyone seen an example log generated by the fix for the 2020-January Critical MS Windows CryptoAPI Vuln? (CVE-2020-0601)

Does anyone know what the exact event event looks like? The technet article: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601/ references the following:

Event Log: Windows Logs/Application
Event Source: Audit-CVE
Event ID 1

Event ID 1 seems to be a common dumping ground, and I've never seen any logs from that SourceName (Assuming that's the field to key on)

I'll (for now) run scheduled searches for the following, but have a feeling the data presents differently.

sourcetype=wineventlog:application SourceName=Audit-CVE

Any ideas/thoughts/suggestions?

Re: MS Crypto API Vuln - CVE-2020-0601 - Any example logs?

rmmiller — Wed, 15 Jan 2020 22:12:08 GMT

One of the handlers at the Internet Storm Center (SANS entity) put together a VBA solution that populates the event log with a replica of these events.

Take a look at https://blog.didierstevens.com/2020/01/15/using-cveeventwrite-from-vba-cve-2020-0601/ for more info.

Hope that helps!
rmmiller

Re: MS Crypto API Vuln - CVE-2020-0601 - Any example logs?

dsctm3 — Wed, 15 Jan 2020 22:55:04 GMT

This is exactly what I was looking for. Many thanks @rmmiller !

Re: MS Crypto API Vuln - CVE-2020-0601 - Any example logs?

rmmiller — Wed, 15 Jan 2020 23:42:42 GMT

Glad I could help! We're all in this mess together! 🙂

Re: MS Crypto API Vuln - CVE-2020-0601 - Any example logs?

Azeemering — Thu, 16 Jan 2020 16:09:27 GMT

https://www.splunk.com/en_us/blog/public-sector/leveraging-splunk-for-a-critically-important-patch-tuesday.html