Windows MSIInstaller EventID 1033 PoC File Takeover String Match (InstallerFileTakeOver/CVE-2021-41379)
Alert on Windows MSI installer EventID 1033 with event data containing 'test pkg', consistent with PoC activity for CVE-2021-41379.
- Product
- windows
- Service
- application
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags a Windows Installer activity where the MSI installer provider (MsiInstaller) emits EventID 1033 and the event data contains the specific string "test pkg" associated with an InstallerFileTakeOver proof-of-concept for CVE-2021-41379. Attackers may use PoC tooling to validate or trigger local privilege escalation paths by abusing vulnerable installer behavior. Detection relies on Windows application logs capturing MsiInstaller EventID 1033 entries and matching the embedded event data substring.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows MSIInstaller EventID 1033 PoC File Takeover String Match (InstallerFileTakeOver/CVE-2021-41379)
id: c8dd81a1-3410-4069-b3d5-25343de9a992
status: test
description: This rule flags a Windows Installer activity where the MSI installer provider (MsiInstaller) emits EventID 1033 and the event data contains the specific string "test pkg" associated with an InstallerFileTakeOver proof-of-concept for CVE-2021-41379. Attackers may use PoC tooling to validate or trigger local privilege escalation paths by abusing vulnerable installer behavior. Detection relies on Windows application logs capturing MsiInstaller EventID 1033 entries and matching the embedded event data substring.
references:
- https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41379/win_vul_cve_2021_41379.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-22
modified: 2022-07-12
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
product: windows
service: application
detection:
selection:
EventID: 1033
Provider_Name: MsiInstaller
Data|contains: test pkg
condition: selection
falsepositives:
- Other MSI packages for which your admins have used that name
level: high
license: DRL-1.1
related:
- id: 7dbb86de-a0cc-494c-8aa8-b2996c9ef3c8
type: derived