CVE2021

CVE-2021-41379

3Rules

4References

1Folders

2024-12-01Latest

Summary

CVE-2021-41379 is tracked here through 3 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2021. Coverage centers on windows / application, windows / file_event, windows / process_creation.

Related Detections

Search this threat

criticaltestEmerging Threat

Potential CVE-2021-41379 Exploitation Attempt

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

windowsprocess_creation

2024-12-01

criticaltestEmerging Threat

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

windowsfile_event

2022-12-25

hightestEmerging Threat

LPE InstallerFileTakeOver PoC CVE-2021-41379

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

windowsapplication

2022-07-12

References

zerodayinitiative.com

Resolving title…

logpoint.com