Windows MSI Installer event logs for PoC strings indicating CVE-2021-41379 exploitation

Alert on Windows MSI installer EventID 1033 with event data containing 'test pkg', consistent with PoC activity for CVE-2021-41379.

FreeUnreviewedSigmahighv1

windows-msi-installer-event-logs-for-poc-strings-indicating-cve-2021-41379-explo-7dbb86de

title: Windows MSI Installer event logs for PoC strings indicating CVE-2021-41379 exploitation
id: c8dd81a1-3410-4069-b3d5-25343de9a992
status: test
description: This rule flags Windows Application log events where the MSI installer provider (MsiInstaller) records EventID 1033 and the event data contains the substring 'test pkg'. The matched string corresponds to PoC usage patterns for an LPE attempt tied to CVE-2021-41379, which may indicate attacker-driven local privilege escalation testing or exploitation. Telemetry relies on Windows Application logs, specifically the MSI installer event payload captured in EventID 1033.
references:
  - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41379/win_vul_cve_2021_41379.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-22
modified: 2022-07-12
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    EventID: 1033
    Provider_Name: MsiInstaller
    Data|contains: test pkg
  condition: selection
falsepositives:
  - Other MSI packages for which your admins have used that name
level: high
license: DRL-1.1
related:
  - id: 7dbb86de-a0cc-494c-8aa8-b2996c9ef3c8
    type: derived

What it detects

This rule flags Windows Application log events where the MSI installer provider (MsiInstaller) records EventID 1033 and the event data contains the substring 'test pkg'. The matched string corresponds to PoC usage patterns for an LPE attempt tied to CVE-2021-41379, which may indicate attacker-driven local privilege escalation testing or exploitation. Telemetry relies on Windows Application logs, specifically the MSI installer event payload captured in EventID 1033.

Known false positives

Other MSI packages for which your admins have used that name

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.