Sigma rule: Potential CVE-2024-35250 Exploitation Activity

Rule

Title

Potential CVE-2024-35250 Exploitation Activity

Status

experimental

Level

medium

Author

@eyezuhk Isaac Fernandes

Date

2025-02-19

File

rules-emerging-threats/2024/Exploits/CVE-2024-35250/image_load_exploit_cve_2024_35250_privilege_escalation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith: '\ksproxy.ax'
filter_main_system_paths:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
filter_optional_teams:
    Image|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
filter_optional_zoom:
    Image|endswith: '\AppData\Roaming\Zoom\bin\Zoom.exe'
filter_optional_firefox:
    Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
filter_optional_chrome:
    Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
filter_optional_opera:
    Image|endswith: '\AppData\Local\Programs\Opera\opera.exe'
filter_optional_discord:
    Image|endswith: '\AppData\Local\Discord\app-*\Discord.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate applications that use Windows Stream Interface APIs.
• Media applications that use DirectShow filters.

Tags

• attack.privilege-escalation
• attack.t1068
• cve.2024-35250
• detection.emerging-threats

CVEs this rule names

• CVE-2024-35250

MITRE ATT&CK ids this rule names

• T1068

References

• https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
• https://github.com/varwara/CVE-2024-35250
• https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/Exploits/CVE-2024-35250/image_load_exploit_cve_2024_35250_privilege_escalation.yml