Coverage › CVE-2022-41033

CVE-2022-41033 Mapped Sigma

Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability

Vendor / product

Microsoft — Windows COM+ Event System Service

Description (CISA)

Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

Added to KEV

2022-10-11

Due date

2022-11-01

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-843

CISA notes

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033
https://nvd.nist.gov/vuln/detail/CVE-2022-41033

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1068 Exploitation for Privilege Escalation primary impact

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1566.001 Spearphishing Attachment exploitation technique

• DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms
  AN0655 Windows

  Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.

  m365:unified Send/Receive: Inbound emails with attachments from suspicious or spoofed senders → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: AttachmentExtensions SuspiciousParentChildPairs TimeWindow
  AN0656 Linux

  Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.

  Application:Mail Inbound email attachments logged from MTAs with suspicious metadata → DC0038 Application Log Content

  auditd:SYSCALL execve: Execution of files saved in mail or download directories → DC0032 Process Creation

  NSM:Flow Outbound traffic from suspicious new processes post-attachment execution → DC0078 Network Traffic Flow

  Tunable: AttachmentStoragePaths ScriptInterpreters
  AN0657 macOS

  Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.

  macos:unifiedlog Inbound messages with attachments from suspicious domains → DC0038 Application Log Content

  macos:unifiedlog Execution of Terminal, osascript, or other interpreters originating from Mail or Preview → DC0032 Process Creation

  macos:unifiedlog Attachment files written to ~/Downloads or temporary folders → DC0039 File Creation

  Tunable: ExecutionDelayThreshold SuspiciousParentApps

Sigma rules tagged attack.t1566.001 (24)

All 24 rules on the technique page →