Emerging Threathightest

LPE InstallerFileTakeOver PoC CVE-2021-41379

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Mon Nov 22Updated Tue Jul 127dbb86de-a0cc-494c-8aa8-b2996c9ef3c82021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Windowsapplication

ProductWindows← raw: windows

Serviceapplication← raw: application

Detection Logic

detection:
    selection:
        EventID: 1033
        Provider_Name: 'MsiInstaller'
        Data|contains: 'test pkg'
    condition: selection

False Positives

Other MSI packages for which your admins have used that name

References

MITRE ATT&CK

Tactics

Techniques

Other

detection.emerging-threats

Rule Metadata

Rule ID

7dbb86de-a0cc-494c-8aa8-b2996c9ef3c8

Status

test

Level

high

Type

Emerging Threat

Created

Mon Nov 22

Modified

Tue Jul 12

Author

Path

rules-emerging-threats/2021/Exploits/CVE-2021-41379/win_vul_cve_2021_41379.yml

Raw Tags

attack.initial-accessattack.t1190detection.emerging-threats