InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•0•21

Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.