Getting Data In

MS Crypto API Vuln - CVE-2020-0601 - Any example logs?

dsctm3
Path Finder

Hello Splunkers!

TL;DR - Has anyone seen an example log generated by the fix for the 2020-January Critical MS Windows CryptoAPI Vuln? (CVE-2020-0601)

Does anyone know what the exact event event looks like? The technet article: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601/ references the following:

  • Event Log: Windows Logs/Application
  • Event Source: Audit-CVE
  • Event ID 1

Event ID 1 seems to be a common dumping ground, and I've never seen any logs from that SourceName (Assuming that's the field to key on)

I'll (for now) run scheduled searches for the following, but have a feeling the data presents differently.

sourcetype=wineventlog:application SourceName=Audit-CVE

Any ideas/thoughts/suggestions?

0 Karma
1 Solution

rmmiller
Contributor

One of the handlers at the Internet Storm Center (SANS entity) put together a VBA solution that populates the event log with a replica of these events.

Take a look at https://blog.didierstevens.com/2020/01/15/using-cveeventwrite-from-vba-cve-2020-0601/ for more info.

Hope that helps!
rmmiller

View solution in original post

dsctm3
Path Finder

This is exactly what I was looking for. Many thanks @rmmiller !

0 Karma

rmmiller
Contributor

Glad I could help! We're all in this mess together! 🙂

rmmiller
Contributor

One of the handlers at the Internet Storm Center (SANS entity) put together a VBA solution that populates the event log with a replica of these events.

Take a look at https://blog.didierstevens.com/2020/01/15/using-cveeventwrite-from-vba-cve-2020-0601/ for more info.

Hope that helps!
rmmiller

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...