CPE
Microsoft Windows: http.sys use-after-free remote code execution (CVE-2021-31166)
1 rule 1 TTP 1 CVEA public proof-of-concept exploit for CVE-2021-31166, a use-after-free vulnerability in the Windows http.sys driver, demonstrates remote code execution via a malformed Accept-Encoding header.
Potential Privileged Escalation via SamAccountName Spoofing (CVE-2021-42278)
2 rules 1 TTP 1 CVEThis rule detects potential privilege escalation attempts by exploiting CVE-2021-42278, which involves spoofing the samAccountName attribute to impersonate a domain controller and elevate privileges from a standard domain user to a domain administrator by identifying suspicious computer account name rename events where a machine account name is renamed to a user-like account name.
Potential Privilege Escalation via InstallerFileTakeOver (CVE-2021-41379)
2 rules 1 TTP 1 CVEThis rule detects potential exploitation of the InstallerTakeOver vulnerability (CVE-2021-41379), where successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.