title: Potential CVE-2021-41379 Exploitation Attempt
id: af8bbce4-f751-46b4-8d91-82a33a736f61
status: test
description: Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights
references:
    - https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver
    - https://www.bleepingcomputer.com/news/microsoft/new-windows-zero-day-with-public-exploit-lets-you-become-an-admin/
    - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
    - https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/
author: Florian Roth (Nextron Systems)
date: 2021-11-22
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2021-41379
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_parent:
        ParentImage|endswith: '\elevation_service.exe'
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384' # System
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical