Potential CVE-2021-41379 Exploitation Attempt

Status: test
Severity: critical
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential CVE-2021-41379 Exploitation Attempt
id: af8bbce4-f751-46b4-8d91-82a33a736f61
status: test
description: Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights
references:
    - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
    - https://www.bleepingcomputer.com/news/microsoft/new-windows-zero-day-with-public-exploit-lets-you-become-an-admin/
    - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
    - https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/
author: Florian Roth (Nextron Systems)
date: 2021-11-22
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2021-41379
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_parent:
        ParentImage|endswith: '\elevation_service.exe'
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384' # System
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\cmd.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'Cmd.Exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: `selection_parent`

selection_parent:
    ParentImage|endswith: '\elevation_service.exe'
    IntegrityLevel:
        - 'System'
        - 'S-1-16-16384'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130) `\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`IntegrityLevel`	eq	`S-1-16-16384` corpus 30 (sigma 22, splunk 4, elastic 3, kusto 1) `System` corpus 30 (sigma 22, splunk 4, elastic 3, kusto 1)	`field:"IntegrityLevel" kind:eq`
`OriginalFileName`	eq	`Cmd.Exe` corpus 81 (sigma 43, elastic 21, splunk 17) `PowerShell.EXE` corpus 138 (sigma 84, splunk 30, elastic 24) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3)	`field:"OriginalFileName" kind:eq`
`ParentImage`	ends_with	`\elevation_service.exe`	`field:"ParentImage" kind:ends_with value:"\elevation_service.exe"`