Coverage › CVE-2022-41073

CVE-2022-41073 Mapped Sigma

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Vendor / product

Microsoft — Windows

Description (CISA)

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

Added to KEV

2022-11-08

Due date

2022-12-09

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-787

CISA notes

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073
https://nvd.nist.gov/vuln/detail/CVE-2022-41073

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1068 Exploitation for Privilege Escalation primary impact

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1078 Valid Accounts exploitation technique

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1574 Hijack Execution Flow secondary impact

• DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
  AN0609 Windows

  Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: ServiceBaseline AllowedDllPaths TimeWindow
  AN0610 Linux

  Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.

  auditd:SYSCALL open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin → DC0061 File Modification

  linux:syslog Service restart with modified executable path → DC0041 Service Metadata

  linux:osquery Process execution with LD_PRELOAD or modified library path → DC0032 Process Creation

  Tunable: MonitoredDirectories EnvVarMonitors
  AN0611 macOS

  Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.

  macos:unifiedlog Execution of process with DYLD_INSERT_LIBRARIES set → DC0032 Process Creation

  macos:unifiedlog Modified application plist or binary replacement in /Applications → DC0061 File Modification

  macos:unifiedlog Dylib loaded from abnormal location → DC0016 Module Load

  Tunable: AllowedDylibPaths PlistMonitors

Sigma rules tagged attack.t1574 (8)