InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

testcritical
Log-Quelle: windows · file_eventAutor Florian Roth (Nextron Systems)Datum 2021-11-22
01

Beschreibung

Was dies ist, in Kürze.

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

02

Tags

attack.privilege-escalationattack.t1068detection.emerging-threats
03

Regelquelle (YAML)

title: InstallerFileTakeOver LPE CVE-2021-41379 File Create Event
id: 3be82d5d-09fe-4d6a-a275-0d40d234d324
status: test
description: Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
references:
    - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
    - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
author: Florian Roth (Nextron Systems)
date: 2021-11-22
modified: 2022-12-25
tags:
    - attack.privilege-escalation
    - attack.t1068
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\msiexec.exe'
        TargetFilename|startswith: 'C:\Program Files (x86)\Microsoft\Edge\Application'
        TargetFilename|endswith: '\elevation_service.exe'
    condition: selection
falsepositives:
    - Unknown
    - Possibly some Microsoft Edge upgrades
level: critical
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.