Windows File Creation of webAdministration.psm1 During CVE-2022-24527 LPE Attempts

title: Windows File Creation of webAdministration.psm1 During CVE-2022-24527 LPE Attempts
id: 8c5efb97-807e-4918-a5b2-b52e0c2275dc
status: test
description: This rule identifies file creation events where the target path ends with WindowsPowerShell\Modules\webAdministration\webAdministration.psm1. Such activity can indicate local privilege exploitation behavior tied to CVE-2022-24527, where an attacker leverages PowerShell module placement to gain elevated execution. The detection relies on Windows file event telemetry and matches on the created file path, excluding cases where the user field contains specific author-related substrings.
references:
  - https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-24527/file_event_win_cve_2022_24527_lpe.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-13
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.t1059.001
  - cve.2022-24527
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: WindowsPowerShell\Modules\webAdministration\webAdministration.psm1
  filter:
    User|contains:
      - AUTHORI
      - AUTORI
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e0a41412-c69a-446f-8e6e-0e6d7483dad7
    type: derived