Windows Potential CVE-2021-41379 InstallerFileTakeOver Privilege Escalation Attempt

Alerts when cmd.exe or PowerShell spawns under Edge elevation service with SYSTEM integrity, consistent with CVE-2021-41379 exploitation.

FreeUnreviewedSigmacriticalv1

windows-potential-cve-2021-41379-installerfiletakeover-privilege-escalation-atte-af8bbce4

title: Windows Potential CVE-2021-41379 InstallerFileTakeOver Privilege Escalation Attempt
id: b0423090-e6f1-4045-94ac-764c619d82fd
status: test
description: This rule flags Windows process creation events that match a likely CVE-2021-41379 exploitation pattern by looking for cmd.exe or PowerShell (cmd.exe/powershell.exe/pwsh) spawning as a child of the Microsoft Edge elevation service (elevation_service.exe). The behavior matters because it can indicate an attacker attempting local privilege escalation to SYSTEM-level integrity. It relies on process creation telemetry, including the child process image/original file name, the parent process image, and the child’s integrity level values corresponding to SYSTEM.
references:
  - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
  - https://www.bleepingcomputer.com/news/microsoft/new-windows-zero-day-with-public-exploit-lets-you-become-an-admin/
  - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
  - https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41379/proc_creation_win_exploit_cve_2021_41379.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-22
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2021-41379
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
  selection_parent:
    ParentImage|endswith: \elevation_service.exe
    IntegrityLevel:
      - System
      - S-1-16-16384
  condition: all of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: af8bbce4-f751-46b4-8d91-82a33a736f61
    type: derived

What it detects

This rule flags Windows process creation events that match a likely CVE-2021-41379 exploitation pattern by looking for cmd.exe or PowerShell (cmd.exe/powershell.exe/pwsh) spawning as a child of the Microsoft Edge elevation service (elevation_service.exe). The behavior matters because it can indicate an attacker attempting local privilege escalation to SYSTEM-level integrity. It relies on process creation telemetry, including the child process image/original file name, the parent process image, and the child’s integrity level values corresponding to SYSTEM.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.