Potential CVE-2024-21338 Exploitation

api where

 process.Ext.api.name == "DeviceIoControl" and user.id != "S-1-5-18" and

 (process.Ext.api.parameters.device : "\\Device\\AppId" or
  (user.id : "S-1-5-19" and process.Ext.api.parameters.device == "Unknown")) and

 /* IOCTL 0x22A018 & 0x22A014 */
 (process.Ext.api.parameters.io_control_code == 2269208 or process.Ext.api.parameters.io_control_code == 2269204) and

 /* exclude expected callers */
 not (process.name == "svchost.exe" and 
      (process.thread.Ext.call_stack_final_user_module.protection_provenance == "appidsvc.dll" or 
       process.thread.Ext.call_stack_final_user_module.name == "appidsvc.dll" or
       process.thread.Ext.call_stack_final_user_module.path like "c:\\windows\\system32\\esent.dll") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller, $caller.trusted == true)) and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "20fae5e8376514a6e500af5a84d08f0f6c58b3302f5c8da48aa74e815a0e78de" and
 not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\system32\\mpssvc.dll", "c:\\windows\\system32\\wevtsvc.dll", "c:\\windows\\assembly\\nativeimages_*\\mscorlib.ni.dll") and
 not (process.executable : "C:\\Program Files\\Windows Defender Advanced Threat Protection\\Classification\\SenseCE.exe" and
      process.parent.executable : "C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe") and
 not (process.executable : "C:\\Windows\\System32\\WUDFHost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe" and
      process.thread.Ext.call_stack_final_user_module.name == "ipf_umdf2.dll") and
 not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\cdp.dll")