Windows MSI Exec Creates elevation_service.exe Under Edge Path (CVE-2021-41379)

Flags msiexec creating elevation_service.exe within the Microsoft Edge application directory, indicating potential LPE exploitation.

FreeReviewedSigma · Critical · v5

Product: windows
Category: file_event
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-11-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1068Exploitation for Privilege Escalation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation activity where an msiexec.exe process targets an Edge application directory and creates an elevation_service.exe file. Such behavior is consistent with exploiting the InstallerFileTakeOver LPE scenario tied to CVE-2021-41379, where elevated file placement enables privilege escalation. It relies on Windows file event telemetry that includes the creating process path (msiexec.exe) and the created file path (elevation_service.exe) under the specified Edge directory.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange

Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)

Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)

Malicious Known Vulnerable Driver Load for BYOVD Attack

Suspicious Vulnerable ASUS AsIO3.sys Driver Load

Malicious Qilin EDR Killer BYOVD Driver Load

Malicious Looney Tunables Privilege Escalation Exploit by Kinsing (via process_creation)

Malicious Kerberos proxiable/S4U2self Ticket - CVE-2021-42278/42287 (via security)

Malicious Vulnerable Driver HwRwDrv Loaded for BYOVD

Possible CopyFail Root Exploitation via Python Spawning SUID Shell (via process_creation)

Windows MSI Exec Creates elevation_service.exe Under Edge Path (CVE-2021-41379)

Pivot detection · T1068 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-create-msiexec-creating-elevation-service-exe-under-edge-applicatio-3be82d5d

title: Windows MSI Exec Creates elevation_service.exe Under Edge Path (CVE-2021-41379)
id: 58c70043-bc7b-4830-ab4f-08e15676975c
status: test
description: This rule flags file creation activity where an msiexec.exe process targets an Edge application directory and creates an elevation_service.exe file. Such behavior is consistent with exploiting the InstallerFileTakeOver LPE scenario tied to CVE-2021-41379, where elevated file placement enables privilege escalation. It relies on Windows file event telemetry that includes the creating process path (msiexec.exe) and the created file path (elevation_service.exe) under the specified Edge directory.
references:
  - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
  - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41379/file_event_win_cve_2021_41379_msi_lpe.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-22
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.t1068
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \msiexec.exe
    TargetFilename|startswith: C:\Program Files (x86)\Microsoft\Edge\Application
    TargetFilename|endswith: \elevation_service.exe
  condition: selection
falsepositives:
  - Unknown
  - Possibly some Microsoft Edge upgrades
level: critical
license: DRL-1.1
related:
  - id: 3be82d5d-09fe-4d6a-a275-0d40d234d324
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL