Windows File Create: msiexec Creating elevation_service.exe Under Edge Application

Flags msiexec creating elevation_service.exe within the Microsoft Edge application directory, indicating potential LPE exploitation.

FreeUnreviewedSigmacriticalv1

windows-file-create-msiexec-creating-elevation-service-exe-under-edge-applicatio-3be82d5d

title: "Windows File Create: msiexec Creating elevation_service.exe Under Edge Application"
id: 58c70043-bc7b-4830-ab4f-08e15676975c
status: test
description: This rule identifies Windows file create events where an msiexec.exe process targets the Microsoft Edge installation directory and creates an elevation_service.exe file. Such activity aligns with exploitation attempts that leverage installer file takeover to achieve local privilege escalation. It relies on telemetry that records the creating process image and the created file’s full target path.
references:
  - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
  - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41379/file_event_win_cve_2021_41379_msi_lpe.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-22
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.t1068
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \msiexec.exe
    TargetFilename|startswith: C:\Program Files (x86)\Microsoft\Edge\Application
    TargetFilename|endswith: \elevation_service.exe
  condition: selection
falsepositives:
  - Unknown
  - Possibly some Microsoft Edge upgrades
level: critical
license: DRL-1.1
related:
  - id: 3be82d5d-09fe-4d6a-a275-0d40d234d324
    type: derived

What it detects

This rule identifies Windows file create events where an msiexec.exe process targets the Microsoft Edge installation directory and creates an elevation_service.exe file. Such activity aligns with exploitation attempts that leverage installer file takeover to achieve local privilege escalation. It relies on telemetry that records the creating process image and the created file’s full target path.

Known false positives

Unknown
Possibly some Microsoft Edge upgrades

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.