CVE-2022-24527 Microsoft Connected Cache LPE File Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects the creation of a specific PowerShell module file ('webAdministration.psm1') within the WindowsPowerShell Modules directory, which is indicative of an attempt to exploit CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The rule filters out activity by authorized users to reduce false positives.