Loading

Potential CVE-2025-33053 Exploitation

Identifies a suspicious Diagnostics Utility for Internet Explorer child process. This may indicate the successful exploitation of the vulnerability CVE-2025-33053.

Rule type: eql
Rule indices:

  • logs-endpoint.events.process-*
  • winlogbeat-*
  • logs-windows.sysmon_operational-*
  • endgame-*
  • logs-m365_defender.event-*
  • logs-sentinel_one_cloud_funnel.*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: ?
References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Initial Access
  • Tactic: Defense Evasion
  • Data Source: Elastic Endgame
  • Data Source: Elastic Defend
  • Data Source: Sysmon
  • Data Source: Microsoft Defender for Endpoint
  • Data Source: SentinelOne
  • Resources: Investigation Guide

Version: ?
Rule authors:

  • Elastic

Rule license: Elastic License v2

  • Review the process details to confirm the suspicious child process was indeed started by iediagcmd.exe.
  • Check any URL file type creation before the alert and review the source of those files.
  • Investigate the process tree and make sure all descendant processes are terminated.
  • Examine the network activity associated with the suspicious process to detect any unauthorized data exfiltration or communication with known malicious IP addresses.
  • Assess the system for any additional indicators of compromise, such as unexpected changes in system files or registry keys, which might suggest a broader attack.
  • This behavior is very rare and should be highly suspicious.
  • Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
  • Terminate the suspicious child process identified in the alert.
  • Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or processes.
  • Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if the threat is part of a larger attack campaign.
  • Implement additional monitoring and alerting for similar suspicious activities involving explorer.exe to enhance detection capabilities and prevent recurrence.
  • Review and update endpoint security policies to restrict the execution of potentially malicious URL files.
process where host.os.type == "windows" and event.type == "start" and
  process.parent.executable : "C:\\Program Files\\Internet Explorer\\iediagcmd.exe" and
  process.name : ("route.exe", "netsh.exe", "ipconfig.exe", "dxdiag.exe", "conhost.exe", "makecab.exe") and
  process.executable != null and
  not process.executable : ("C:\\Windows\\System32\\route.exe",
                            "C:\\Windows\\System32\\netsh.exe",
                            "C:\\Windows\\System32\\ipconfig.exe",
                            "C:\\Windows\\System32\\dxdiag.exe",
                            "C:\\Windows\\System32\\conhost.exe",
                            "C:\\Windows\\System32\\makecab.exe")

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK