CVE-2022-24527 Microsoft Connected Cache LPE

calendar Oct 23, 2025 · attack.execution attack.privilege-escalation attack.t1059.001 cve.2022-24527 detection.emerging-threats  ·
Share on: linkedin copy

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Sigma rule (View on GitHub)

 1title: CVE-2022-24527 Microsoft Connected Cache LPE
 2id: e0a41412-c69a-446f-8e6e-0e6d7483dad7
 3status: test
 4description: Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache
 5references:
 6    - https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/
 7author: Florian Roth (Nextron Systems)
 8date: 2022-04-13
 9tags:
10    - attack.execution
11    - attack.privilege-escalation
12    - attack.t1059.001
13    - cve.2022-24527
14    - detection.emerging-threats
15logsource:
16    category: file_event
17    product: windows
18detection:
19    selection:
20        TargetFilename|endswith: 'WindowsPowerShell\Modules\webAdministration\webAdministration.psm1'
21    filter:
22        User|contains: # covers many language settings
23            - 'AUTHORI'
24            - 'AUTORI'
25    condition: selection and not filter
26falsepositives:
27    - Unknown
28level: high

References

Related rules

to-top