CVE2022

CVE-2022-21919

1Rules

1References

1Folders

2025-11-03Latest

Summary

CVE-2022-21919 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2022. Coverage centers on windows / application.

Related Detections

Search this threat

Emerging Threatlowtest

Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE

Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service. During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives). Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.

Windowsapplication

TA0002 · Executiondetection.emerging-threatscve.2022-21919cve.2021-34484

CybexTue Aug 162022

References

Resolving title…

packetstormsecurity.com