dell-driver-vulnerability-2021
This query was originally published in the threat analytics report, Multiple EOP flaws in Dell driver (CVE-2021-21551). CVE-2021-21551 is a vulnerability found in dbutil_2_3.sys, a driver distributed with Dell firmware updates and tools. Attackers can exploit this vulnerability to escalate privileges on a compromised device. The following query can detect if the affected driver has been added to a device's \temp folders. Reference - https://nvd.nist.gov/vuln/detail/CVE-2021-21551
Microsoft Sentinel (KQL)
