LPE InstallerFileTakeOver PoC CVE-2021-41379

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•0•21

Detects the use of a Proof-of-Concept (PoC) tool designed to exploit the Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. The rule specifically looks for MsiInstaller Event ID 1033 with the data containing 'test pkg', which is indicative of the PoC's activity.