Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Emerging Threats
    CVE2022

    CVE-2022-21919

    1Rules
    1References
    1Folders
    2025-11-03Latest
    Summary

    CVE-2022-21919 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2022. Coverage centers on windows / application.

    Related Detections
    Search this threat
    1 rulesInspect a rule without leaving your results.
    lowtestEmerging Threat

    Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE

    Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service. During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives). Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.

    windowsapplication
    2025-11-03
    References
    1
    Resolving title…
    packetstormsecurity.com