Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Alerts on Windows Audit-CVE EventID 1 entries from Microsoft-Windows-Audit-CVE provider indicating CveEventWrite activity.

FreeReviewedSigma · Critical · v2

Product: windows
Service: application
Author: Florian Roth (Nextron Systems), Zach Mathis (SigmaHQ), DRL 1.1
Published: 2020-01-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Impact

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
- T1068Exploitation for Privilege Escalation
Defense Evasion
- T1211Exploitation for Stealth
Cred Access
- T1212Exploitation for Credential Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact
- T1499.004Application or System Exploitation

What it detects

This rule flags Windows application log events from the Microsoft-Windows-Audit-CVE provider, matching Event ID 1, that are generated when a user-mode application calls the CveEventWrite API. Attackers may use these events to surface or signal exploitation attempts tied to specific CVE activity, making this useful for spotting anomalous vulnerability-reporting behavior. Telemetry relies on Windows Application logs capturing the Provider_Name and EventID values for the Audit-CVE event stream.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)

Suspicious Vulnerable ASUS AsIO3.sys Driver Load

Malicious Bring-Your-Own-Vulnerable-Driver Load By BlackByte

Windows spoolsv.exe Child Process Execution Indicators

Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)

Malicious Known Vulnerable Driver Load for BYOVD Attack

Malicious Qilin EDR Killer BYOVD Driver Load

Malicious Looney Tunables Privilege Escalation Exploit by Kinsing (via process_creation)

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Pivot detection · T1068 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-application-audit-cve-microsoft-windows-audit-cve-eventid-1-from-cveeven-48d91a3a

title: "Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)"
id: da21ed25-6bef-4545-8ef2-7dc073c17e7f
status: test
description: This rule flags Windows application log events from the Microsoft-Windows-Audit-CVE provider, matching Event ID 1, that are generated when a user-mode application calls the CveEventWrite API. Attackers may use these events to surface or signal exploitation attempts tied to specific CVE activity, making this useful for spotting anomalous vulnerability-reporting behavior. Telemetry relies on Windows Application logs capturing the Provider_Name and EventID values for the Audit-CVE event stream.
references:
  - https://twitter.com/VM_vivisector/status/1217190929330655232
  - https://twitter.com/DidierStevens/status/1217533958096924676
  - https://twitter.com/FlemmingRiis/status/1217147415482060800
  - https://www.youtube.com/watch?v=ebmW42YYveI
  - https://nullsec.us/windows-event-log-audit-cve/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml
author: Florian Roth (Nextron Systems), Zach Mathis, Huntrule Team
date: 2020-01-15
modified: 2022-10-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1211
  - attack.credential-access
  - attack.t1212
  - attack.lateral-movement
  - attack.t1210
  - attack.impact
  - attack.t1499.004
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name:
      - Microsoft-Windows-Audit-CVE
      - Audit-CVE
    EventID: 1
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 48d91a3a-2363-43ba-a456-ca71ac3da5c2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL