Sigma rule: Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-647124d8b2a8, updated 2025-11-03T00:00:00.000Z.

Rule

Title
Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE
Status
test
Level
low
Author
Cybex
Date
2022-08-16
Modified
2025-11-03
File
rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service.
During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives).
Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.

Log source

product
windows
service
application

Detection

selection:
    EventID: 1511
    Provider_Name: 'Microsoft-Windows-User Profiles Service'
condition: selection

False positives (as the rule lists them)

  • Corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx

Tags

  • attack.execution
  • detection.emerging-threats
  • cve.2022-21919
  • cve.2021-34484

CVEs this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml

Sources and licences

  • SigmaHQ

    "Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE" by Cybex (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE",
entity page, dataset version ref-647124d8b2a8, updated 2025-11-03T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/52a85084-6989-40c3-8f32-091e12e17692 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 52a85084-6989-40c3-8f32-091e12e17692, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.