CVE-2021-41379

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Oct 26, 2023 · attack.privilege_escalation attack.t1068 detection.emerging_threats ·

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

LPE InstallerFileTakeOver PoC CVE-2021-41379

Oct 26, 2023 · attack.initial_access attack.t1190 detection.emerging_threats ·

Share on:

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Potential CVE-2021-41379 Exploitation Attempt

Oct 18, 2023 · attack.privilege_escalation attack.t1068 cve.2021.41379 detection.emerging_threats ·

Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights