CVE-2021-41379

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "msiexec.exe" or InitiatingProcessParentFileName =~ "msiexec.exe"
| where ProcessCommandLine contains "/i" or ProcessCommandLine contains "/x" // Installer/Uninstaller activity
| where InitiatingProcessIntegrityLevel == "Low" or InitiatingProcessIntegrityLevel == "Medium" // Low-privileged process
| join kind=inner (DeviceFileEvents
    | where ActionType == "FileCreated" and FileName contains ".lnk" // Junction/symlink creation indicator
    | where InitiatingProcessIntegrityLevel == "Low" or InitiatingProcessIntegrityLevel == "Medium"
    | summarize JunctionCreationTime = min(TimeGenerated) by DeviceId, InitiatingProcessId
) on DeviceId, InitiatingProcessId
| join kind=inner (DeviceFileEvents
    | where ActionType == "FileDeleted" or ActionType == "DirectoryDeleted"
    | where InitiatingProcessIntegrityLevel == "System" // SYSTEM-level deletion
    | summarize DeletionTime = min(TimeGenerated) by DeviceId, InitiatingProcessId
) on DeviceId, InitiatingProcessId
| where DeletionTime > JunctionCreationTime and DeletionTime < JunctionCreationTime + 1h // Deletion shortly after junction creation
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, ActionType, JunctionCreationTime, DeletionTime

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (EventCode=4688 OR EventCode=1) ProcessName IN ("msiexec.exe")
| search CommandLine IN ("*/i*", "*/x*")
| search (User_Integrity_Level="Low" OR User_Integrity_Level="Medium")
| transaction ProcessId startswith (EventCode=1 OR EventCode=4688) ProcessName IN ("msiexec.exe") CommandLine IN ("*/i*", "*/x*") (User_Integrity_Level="Low" OR User_Integrity_Level="Medium") endswith (EventCode=11 OR EventCode=23) (TargetFilename="*.lnk*" OR TargetFilename="*.symlink*") (User_Integrity_Level="Low" OR User_Integrity_Level="Medium")
| search (EventCode=11 OR EventCode=23) (TargetFilename="*.lnk*" OR TargetFilename="*.symlink*") (User_Integrity_Level="Low" OR User_Integrity_Level="Medium")
| join ProcessId
    [ search index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
    | (EventCode=11 OR EventCode=23) (TargetFilename="*.lnk*" OR TargetFilename="*.symlink*") (User_Integrity_Level="Low" OR User_Integrity_Level="Medium")
    | rename _time as JunctionCreationTime
    | fields ProcessId, JunctionCreationTime
    ]
| join ProcessId
    [ search index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
    | (EventCode=11 OR EventCode=23) (TargetFilename="*" OR TargetFilename="*") (User_Integrity_Level="System")
    | rename _time as DeletionTime
    | fields ProcessId, DeletionTime
    ]
| where DeletionTime > JunctionCreationTime AND DeletionTime < relative_time(JunctionCreationTime, "+1h")
| table _time, host, ProcessName, CommandLine, User_Integrity_Level, TargetFilename, JunctionCreationTime, DeletionTime

Sigma

title: Windows Installer Privilege Escalation via Junction Abuse
id: 9a1b2c3d-4e5f-6789-abcd-ef0123456789
status: experimental
description: Detects potential privilege escalation attempts abusing the Windows Installer service by creating junctions and triggering file deletions.
author: SecBoard Operations
date: 2023/10/27
modified: 2023/10/27
tags:
  - attack.privilege_escalation
  - cve.2021-41379
  - cisa_kev
logsource:
  category: process_creation
  product: windows
detection:
  selection_installer:
    Image|endswith:
      - '\msiexec.exe'
    CommandLine|contains:
      - '/i'
      - '/x'
  filter_low_privilege:
    IntegrityLevel:
      - 'Low'
      - 'Medium'
  selection_junction_creation:
    EventID: 11 # Sysmon FileCreate
    TargetFilename|endswith:
      - '.lnk'
      - '.symlink'
  selection_system_deletion:
    EventID: 23 # Sysmon FileDelete
    IntegrityLevel: 'System'
  condition: all of selection_installer and filter_low_privilege and selection_junction_creation and selection_system_deletion
falsepositives:
  - Legitimate software installations/updates that might involve complex file operations.
level: high

Elastic ES|QL

from process where event.action == "process_started" and (process.executable : "*\\msiexec.exe" or process.parent.executable : "*\\msiexec.exe") and (process.args : "/i" or process.args : "/x") and (process.integrity_level : "low" or process.integrity_level : "medium")
| join (from file where event.action == "creation" and (file.extension : "lnk" or file.extension : "symlink") and (process.integrity_level : "low" or process.integrity_level : "medium")) on process.entity_id
| join (from file where event.action == "deletion" and process.integrity_level : "system") on process.entity_id
| where file.creation.timestamp < file.deletion.timestamp and file.deletion.timestamp < file.creation.timestamp + INTERVAL 1 HOUR
| select @timestamp, host.name, process.executable, process.command_line, process.integrity_level, file.path, event.action, file.creation.timestamp, file.deletion.timestamp