Windows: User Profiles Service EventID 1511 indicating potential CVE-2022-21919 or CVE-2021-34484 LPE
Alerts on User Profiles Service Event ID 1511, a possible signal of LPE exploitation attempts associated with CVE-2022-21919 or CVE-2021-34484.
- Product
- windows
- Service
- application
- Author
- Cybex (SigmaHQ), DRL 1.1
- Published
- 2022-08-16
- Updated
- 2026-07-31
What it detects
This rule flags Windows events from the Microsoft-Windows-User Profiles Service with EventID 1511, which can correspond to attempts to exploit CVE-2022-21919 or CVE-2021-34484 for local privilege escalation via the User Profile Service. Such exploitation matters because it may enable escalation from a lower-privileged context. It relies on Windows application/service telemetry capturing Provider_Name and EventID for the User Profiles Service, with the accompanying guidance noting additional related events (EventID 1515) and possible creation of \Users\TEMP during exploitation.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: User Profiles Service EventID 1511 indicating potential CVE-2022-21919 or CVE-2021-34484 LPE"
id: dcd14592-75f5-4a7d-9be8-f022c193813f
status: test
description: This rule flags Windows events from the Microsoft-Windows-User Profiles Service with EventID 1511, which can correspond to attempts to exploit CVE-2022-21919 or CVE-2021-34484 for local privilege escalation via the User Profile Service. Such exploitation matters because it may enable escalation from a lower-privileged context. It relies on Windows application/service telemetry capturing Provider_Name and EventID for the User Profiles Service, with the accompanying guidance noting additional related events (EventID 1515) and possible creation of \Users\TEMP during exploitation.
references:
- https://packetstormsecurity.com/files/166692/Windows-User-Profile-Service-Privlege-Escalation.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml
author: Cybex, Huntrule Team
date: 2022-08-16
modified: 2025-11-03
tags:
- attack.execution
- detection.emerging-threats
- cve.2022-21919
- cve.2021-34484
logsource:
product: windows
service: application
detection:
selection:
EventID: 1511
Provider_Name: Microsoft-Windows-User Profiles Service
condition: selection
falsepositives:
- Corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx
level: low
license: DRL-1.1
related:
- id: 52a85084-6989-40c3-8f32-091e12e17692
type: derived