c-ares TCP UAF Exploitation - Unexpected Child Process from DNS-Resolving App
Detects evidence of exploitation targeting a use-after-free vulnerability in the c-ares DNS library. The rule monitors for three primary indicators: abnormal child process creation (e.g., cmd.exe or calc.exe) originating from applications known to link against c-ares (like node.exe or curl.exe), the presence of specific proof-of-concept (PoC) artifact files on disk, and the direct execution of identified c-ares exploitation harness binaries or scripts.
Microsoft Sentinel (KQL)
