Windows: User Profiles Service events (1511) indicating possible LPE attempts tied to CVE-2022-21919/CVE-2021-34484

Alerts on User Profiles Service Event ID 1511, a possible signal of LPE exploitation attempts associated with CVE-2022-21919 or CVE-2021-34484.

FreeUnreviewedSigmalowv1

windows-user-profiles-service-events-1511-indicating-possible-lpe-attempts-tied--52a85084

title: "Windows: User Profiles Service events (1511) indicating possible LPE attempts tied to CVE-2022-21919/CVE-2021-34484"
id: dcd14592-75f5-4a7d-9be8-f022c193813f
status: test
description: This rule flags Windows systems where the Microsoft-Windows-User Profiles Service logs Event ID 1511, which can indicate attempts to exploit CVE-2022-21919 or CVE-2021-34484 for local privilege escalation. Such activity matters because successful exploitation may alter user profile handling to gain elevated privileges. Telemetry relies on Application log events with Provider_Name set to Microsoft-Windows-User Profiles Service and EventID 1511.
references:
  - https://packetstormsecurity.com/files/166692/Windows-User-Profile-Service-Privlege-Escalation.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml
author: Cybex, Huntrule Team
date: 2022-08-16
modified: 2025-11-03
tags:
  - attack.execution
  - detection.emerging-threats
  - cve.2022-21919
  - cve.2021-34484
logsource:
  product: windows
  service: application
detection:
  selection:
    EventID: 1511
    Provider_Name: Microsoft-Windows-User Profiles Service
  condition: selection
falsepositives:
  - Corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx
level: low
license: DRL-1.1
related:
  - id: 52a85084-6989-40c3-8f32-091e12e17692
    type: derived

What it detects

This rule flags Windows systems where the Microsoft-Windows-User Profiles Service logs Event ID 1511, which can indicate attempts to exploit CVE-2022-21919 or CVE-2021-34484 for local privilege escalation. Such activity matters because successful exploitation may alter user profile handling to gain elevated privileges. Telemetry relies on Application log events with Provider_Name set to Microsoft-Windows-User Profiles Service and EventID 1511.

Known false positives

Corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.