Potential CVE-2021-41379 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•24

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability. This rule specifically looks for instances where a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) is spawned as a child process of the Microsoft Edge elevation service (elevation_service.exe) with SYSTEM integrity level, indicating a successful privilege escalation.