Coverage › CVE-2025-21391

CVE-2025-21391 Mapped Sigma

Microsoft Windows Storage Link Following Vulnerability

Vendor / product

Microsoft — Windows

Description (CISA)

Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.

Added to KEV

2025-02-11

Due date

2025-03-04

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-59

CISA notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391
https://nvd.nist.gov/vuln/detail/CVE-2025-21391

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1068 Exploitation for Privilege Escalation exploitation technique

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1485 Data Destruction primary impact

• DET0146 Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns
  AN0411 Windows

  Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion

  Tunable: TargetFilename ProcessCommandLine VolumeThreshold TimeWindow
  AN0412 Linux

  Massive recursive deletions or overwrites via rm -rf, shred, dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.

  auditd:SYSCALL unlink, unlinkat, openat, write → DC0040 File Deletion

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: ExecutablePath DeletedPathPattern SyscallBurstRate
  AN0413 macOS

  Destruction via rm -rf, overwrite with dd or srm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.

  macos:unifiedlog exec rm -rf|dd if=/dev|srm|file unlink → DC0040 File Deletion

  macos:unifiedlog process.*exit.*code → DC0033 Process Termination

  Tunable: CommandPattern EntropyChangeRate
  AN0414 IaaS

  Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with Delete* or TerminateInstances.

  AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances → DC0022 Cloud Storage Deletion

  Tunable: OperationType UserAgent RegionScope
  AN0415 ESXi

  Adversary destroys virtual disks (VMDK), images, or VMs by invoking vim-cmd, deleting datastore contents, or purging snapshots.

  esxi:vmkernel file delete|datastore purge → DC0098 Volume Deletion

  Tunable: DatastorePath InitiatingUser
  AN0416 Containers

  Container process executes destructive file operations inside volume mounts or host paths. Includes rm -rf /mnt/volumes/, container breakout followed by host deletion attempts.

  auditd:SYSCALL unlink, unlinkat, rmdir → DC0040 File Deletion

  docker:events container exec rm|container stop --force → DC0064 Command Execution

  Tunable: MountPoint ContainerImage

Sigma rules tagged attack.t1485 (20)

All 20 rules on the technique page →

T1490 Inhibit System Recovery primary impact

• DET0329 Behavioral Detection for T1490 - Inhibit System Recovery
  AN0933 Windows

  Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Microsoft-Windows-Backup Windows Backup Catalog deletion or catalog corruption → DC0040 File Deletion

  WinEventLog:System Service stopped or RecoveryDisabled set via REAgentC → DC0041 Service Metadata

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: TimeWindow CommandLinePattern ParentProcessContext
  AN0934 Linux

  Shell utilities or scripts deleting /etc/systemd/system/rescue.target, /etc/fstab backups, or /boot/efi partitions; chattr used to block snapshot auto-recovery

  auditd:SYSCALL chattr, rm, shred, dd run on recovery directories or partitions → DC0064 Command Execution

  auditd:CONFIG_CHANGE /etc/fstab, /etc/systemd/* → DC0040 File Deletion

  Tunable: WatchedFilePaths ShellProcessUser
  AN0935 ESXi

  ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths

  esxi:hostd snapshot.removeall or snapshot file deletion → DC0049 Snapshot Deletion

  Tunable: TargetVMNames
  AN0936 Network Devices

  Execution of erase, format, and reload in immediate sequence from a privileged AAA session

  networkdevice:syslog command sequence: erase → format → reload → DC0064 Command Execution

  Tunable: CommandSequenceWindow UserPrivilegeLevel
  AN0937 IaaS

  Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations

  AWS:CloudTrail DeleteSnapshot → DC0049 Snapshot Deletion

  AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances → DC0022 Cloud Storage Deletion

  Tunable: UserAgent ResourceType

Sigma rules tagged attack.t1490 (27)

All 27 rules on the technique page →