Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE

Description

Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service. During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives). Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.

Query · sigma

selection:
  EventID: 1511
  Provider_Name: Microsoft-Windows-User Profiles Service
condition: selection

Known false positives

  • Corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx
Raw source Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE
id: 52a85084-6989-40c3-8f32-091e12e17692
status: test
description: |
    Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service.
    During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives).
    Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.
references:
    - https://packetstormsecurity.com/files/166692/Windows-User-Profile-Service-Privlege-Escalation.html
author: Cybex
date: 2022-08-16
modified: 2025-11-03
tags:
    - attack.execution
    - detection.emerging-threats
    - cve.2022-21919
    - cve.2021-34484
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1511
        Provider_Name: 'Microsoft-Windows-User Profiles Service'
    condition: selection
falsepositives:
    - Corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx
level: low

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.