CVE-2025-62221

CVE-2025-62221 Microsoft Windows Use After Free Exploitation

Privilege Escalation Execution Last updated:

Detects exploitation attempts of CVE-2025-62221, a use-after-free vulnerability in Microsoft Windows. This class of memory corruption flaw allows attackers to execute arbitrary code by manipulating freed memory objects. As a CISA KEV entry, active exploitation in the wild has been confirmed. Detection focuses on anomalous process behavior, kernel-mode memory corruption indicators, crash telemetry, and privilege escalation patterns consistent with UAF exploitation chains.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Microsoft
Product
Windows

Weakness (CWE)

CWE-416

Timeline

Disclosed
December 9, 2025

CVSS

7.8
High (7.0–8.9)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2025-62221 CVE-2025-62221 Microsoft Windows Use After Free Exploitation?

CVE-2025-62221 Microsoft Windows Use After Free Exploitation (CVE-2025-62221) maps to the Privilege Escalation and Execution tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for CVE-2025-62221 Microsoft Windows Use After Free Exploitation, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Windows Security Events, Azure Monitor. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Execution
Microsoft Sentinel / Defender
kusto 
let timeframe = 24h;
let suspiciousProcesses = dynamic(["lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe"]);
union
(
    SecurityEvent
    | where TimeGenerated >= ago(timeframe)
    | where EventID in (4688, 4689)
    | where NewProcessName has_any ("exploit", "shellcode") or
            (ParentProcessName in~ (suspiciousProcesses) and NewProcessName !in~ (suspiciousProcesses))
    | project TimeGenerated, Computer, Account, NewProcessName, ParentProcessName, CommandLine, EventID
),
(
    DeviceEvents
    | where TimeGenerated >= ago(timeframe)
    | where ActionType in ("ExploitGuardNetworkProtectionAudited", "ExploitGuardNetworkProtectionBlocked", "MemoryAllocationViolation", "UnexpectedKernelWriteAttempt")
    | project TimeGenerated, DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields
),
(
    DeviceProcessEvents
    | where TimeGenerated >= ago(timeframe)
    | where InitiatingProcessIntegrityLevel == "High" and AccountName != "SYSTEM"
    | where ProcessVersionInfoOriginalFileName in~ (suspiciousProcesses) or
            (InitiatingProcessParentFileName in~ (suspiciousProcesses) and InitiatingProcessFileName !in~ (suspiciousProcesses))
    | project TimeGenerated, DeviceName, AccountName, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| extend CVE = "CVE-2025-62221"
| sort by TimeGenerated desc

Detects process anomalies, memory violation events, and privilege escalation patterns consistent with CVE-2025-62221 Windows use-after-free exploitation using Defender for Endpoint and Security Event logs.

critical severity medium confidence

Data Sources

Microsoft Defender for Endpoint Windows Security Events Azure Monitor

Required Tables

SecurityEvent DeviceEvents DeviceProcessEvents

False Positives

  • Legitimate software installers or update agents spawning child processes from system parents
  • Security scanning tools or EDR agents performing memory inspection may trigger memory violation events
  • Administrative scripts running under elevated context that spawn unusual child processes
  • Crash dump collection utilities accessing process memory post-crash

Sigma rule & cross-platform mapping

The detection logic for CVE-2025-62221 Microsoft Windows Use After Free Exploitation (CVE-2025-62221) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2025-62221 Sigma rules on detection.fyi

Platform-specific guides for CVE-2025-62221

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (2)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate UAF-style anomalous child process from lsass.exe parent (lab only)

    Expected signal: Sysmon Event ID 1 with ParentImage pointing to lsass.exe and Image of cmd.exe; Windows Security EventID 4688 with anomalous parent-child relationship

  2. Test 2WER crash trigger on system process to simulate pre-exploit crash artifacts

    Expected signal: Windows Event ID 1000 (Application Error) and 1001 (Windows Error Reporting) in Application event log; WER report created in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue

  3. Test 3Elevated token process launch from spoofed system parent context

    Expected signal: Sysmon Event ID 1 showing cmd.exe with IntegrityLevel=System spawned by psexec service; Windows Security EventID 4688 with elevated token; EventID 4672 (special privileges assigned to new logon)

  4. Test 4Heap spray pattern simulation via PowerShell memory allocation

    Expected signal: PowerShell Script Block Logging (EventID 4104) capturing the allocation loop; potential AMSI or Defender behavioral alert on large sequential memory allocation patterns

Response Playbook

Triage

  1. Verify the affected host's patch level against Microsoft's December 2025 Patch Tuesday updates; confirm whether the CVE-2025-62221 patch has been applied via 'wmic qfe list' or Windows Update history
  2. Review the alerting process's full ancestry tree — identify which Windows system process is the immediate parent and trace back to the root initiating process or user session
  3. Examine process memory characteristics using Defender ATP advanced hunting or CrowdStrike process tree: look for indicators of heap spray, ROP gadgets, or unusual shellcode regions in adjacent process memory
  4. Correlate the event time with network connections from the affected host — use DeviceNetworkEvents or equivalent to identify any C2 beaconing or lateral movement immediately after the anomalous process launch
  5. Check for newly created files, registry run keys, or scheduled tasks created within 5 minutes of the suspicious process activity that may indicate persistence establishment post-exploitation

Containment

  1. Isolate the affected host from the network immediately using EDR isolation capability (CrowdStrike Network Contain or Defender for Endpoint device isolation) to prevent lateral movement or C2 communication
  2. Terminate the suspicious child process and any descendant processes it may have spawned, then preserve a memory dump of the parent system process for forensic analysis before any remediation
  3. Revoke any authentication tokens or Kerberos tickets associated with the compromised user session and force re-authentication from a clean endpoint

Evidence Collection

  1. Collect a full memory dump of the affected Windows system process (lsass, csrss, etc.) and the suspicious child process using WinPmem or via EDR memory acquisition for offline heap/UAF analysis
  2. Export Windows Security Event logs (EventIDs 4624, 4625, 4688, 4672, 4673), Sysmon logs, and PowerShell operational logs from the affected host covering at least 2 hours before and after the detection trigger
  3. Capture network packet capture (PCAP) from the host or nearest network tap covering the exploitation window to identify payload delivery mechanism and any post-exploitation C2 traffic

Escalation Criteria

  • ! Escalate immediately if the process spawned from lsass.exe, csrss.exe, or winlogon.exe gains SYSTEM-level privileges, accesses credential stores, or initiates lateral movement via SMB, WMI, or RDP
  • ! Escalate to incident response team if the same CVE-2025-62221 pattern is observed across more than two hosts within a 1-hour window, indicating active campaign or worm-like spreading behavior

Investigation Guide

Forensic Artifacts

  • > Windows Error Reporting (WER) crash dumps in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue — UAF exploitation often generates crash artifacts before successful exploitation
  • > Prefetch files for any unusual executables spawned from system processes (C:\Windows\Prefetch\*.pf)
  • > Windows Event Log entries: EventID 7031/7034 (Service crashed), EventID 1000/1001 (Application Error/Fault Bucket), and EventID 4688 (Process Create) correlating with exploitation time
  • > Memory forensics: heap structures showing freed object reuse patterns in affected Windows process memory pages using Volatility or WinDbg with !heap -a

Tuning Guidance

Start with high-confidence process ancestry rules and tune out known-good parent-child pairs specific to your environment's management tooling (e.g., SCCM, Intune, CrowdStrike, Defender). Whitelist by hash or signed binary path rather than process name alone to prevent evasion via renamed binaries. Increase confidence thresholds by correlating process anomalies with concurrent crash events (WER) or network connections from the same host. For environments with heavy automation, consider time-boxing detection to off-hours or correlating with user login sessions to reduce alert volume. Once the specific vulnerable Windows component is publicly identified, narrow the query to target that component's process name directly.

Hunting Queries

Threat hunt for repeated crashes in Windows system processes that may indicate failed UAF exploitation attempts (spray-and-pray) preceding a successful CVE-2025-62221 exploit. Repeated crashes of system processes are a strong pre-exploitation indicator.

Hunting — KQL
kql 
DeviceCrashEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("lsass.exe", "csrss.exe", "winlogon.exe", "svchost.exe")
| summarize crash_count=count(), first_crash=min(Timestamp), last_crash=max(Timestamp) by DeviceName, FileName, FaultingModuleName
| where crash_count >= 2
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp >= ago(7d)
    | where InitiatingProcessFileName in~ ("lsass.exe", "csrss.exe", "winlogon.exe", "svchost.exe")
    | summarize anomalous_spawns=count() by DeviceName, InitiatingProcessFileName
) on DeviceName
| project DeviceName, FileName, FaultingModuleName, crash_count, anomalous_spawns, first_crash, last_crash
Hunting — SPL
spl 
index=windows (EventCode=1000 OR EventCode=1001 OR EventCode=7031 OR EventCode=7034)
| eval affected_process=coalesce(param1, ProcessName)
| where affected_process IN ("lsass.exe", "csrss.exe", "winlogon.exe", "svchost.exe", "services.exe")
| stats count as crash_events min(_time) as first_seen max(_time) as last_seen by host, affected_process, EventCode
| where crash_events >= 2
| sort - crash_events

Atomic Red Team Tests

Test 1 Simulate UAF-style anomalous child process from lsass.exe parent (lab only)
windows

Uses a test harness to spawn a cmd.exe child process appearing to originate from lsass.exe by manipulating parent process ID via NtCreateUserProcess, simulating the process ancestry pattern seen in UAF exploitation.

Command

powershell 
# Requires Atomic Red Team or custom parent-spoofing tool
# Example using SelectMyParent (lab tool):
# SelectMyParent.exe cmd.exe <PID_OF_LSASS>
$lsassPid = (Get-Process lsass).Id
Write-Host "LSASS PID: $lsassPid"
# In lab: inject or use parent-spoof tool targeting this PID
# DO NOT run on production systems

Cleanup

powershell 
Stop-Process -Name cmd -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with ParentImage pointing to lsass.exe and Image of cmd.exe; Windows Security EventID 4688 with anomalous parent-child relationship

Expected Detection

KQL DeviceProcessEvents and Sysmon SPL queries should trigger on the anomalous parent-child process relationship within 60 seconds

Test 2 WER crash trigger on system process to simulate pre-exploit crash artifacts
windows

Forces a non-critical test process crash to generate WER artifacts similar to those produced during failed UAF exploitation spray attempts against Windows system components.

Command

powershell 
# Create a simple C program that crashes via use-after-free in user space (lab)
# For testing purposes, use NotMyFault from Sysinternals to trigger a controlled crash:
# notmyfault.exe /crash  (requires kernel driver — lab only)
# Simpler: trigger access violation in test process
$code = @'
#include <windows.h>
int main() { int* p = (int*)malloc(4); free(p); *p = 42; return 0; }
'@
$code | Out-File -FilePath C:\Temp\uaf_test.c -Encoding ASCII
Write-Host "Compile and run uaf_test.c in lab environment to generate WER artifacts"

Cleanup

powershell 
Remove-Item C:\Temp\uaf_test.c -Force -ErrorAction SilentlyContinue; Get-ChildItem $env:LOCALAPPDATA\Microsoft\Windows\WER\ReportQueue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddMinutes(-5)} | Remove-Item -Recurse -Force

Expected Telemetry

Windows Event ID 1000 (Application Error) and 1001 (Windows Error Reporting) in Application event log; WER report created in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue

Expected Detection

Hunting query for repeated crash events on system processes should surface this within the crash correlation window

Test 3 Elevated token process launch from spoofed system parent context
windows

Tests detection of a high-integrity process launch that appears to originate from a Windows system process, simulating the privilege escalation outcome of successful CVE-2025-62221 exploitation.

Command

powershell 
# Using Token Impersonation test (lab — requires local admin)
# PsExec to simulate SYSTEM context child process:
psexec.exe -s -i cmd.exe /c whoami > C:\Temp\uaf_test_output.txt
type C:\Temp\uaf_test_output.txt

Cleanup

powershell 
Remove-Item C:\Temp\uaf_test_output.txt -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe with IntegrityLevel=System spawned by psexec service; Windows Security EventID 4688 with elevated token; EventID 4672 (special privileges assigned to new logon)

Expected Detection

CrowdStrike CQL query on TokenIsElevated=1 with system-process parent should alert; KQL DeviceProcessEvents integrity level correlation should trigger within detection window

Test 4 Heap spray pattern simulation via PowerShell memory allocation
windows

Simulates heap spray memory patterns often used in conjunction with UAF exploits to position controlled data in freed memory regions, generating telemetry detectable by memory protection systems.

Command

powershell 
# Lab-only heap spray simulation — no shellcode, benign allocation pattern
$heapSpraySize = 100MB
$allocations = New-Object System.Collections.ArrayList
for ($i = 0; $i -lt 100; $i++) {
    $buf = New-Object byte[] (1MB)
    [Array]::Fill($buf, [byte]0x41)  # Fill with 'A' — benign marker
    $allocations.Add($buf) | Out-Null
}
Write-Host "Allocated $($allocations.Count) 1MB buffers — heap spray pattern simulated"
Start-Sleep -Seconds 5
$allocations.Clear()
[System.GC]::Collect()

Cleanup

powershell 
[System.GC]::Collect(); Write-Host 'Memory released'

Expected Telemetry

PowerShell Script Block Logging (EventID 4104) capturing the allocation loop; potential AMSI or Defender behavioral alert on large sequential memory allocation patterns

Expected Detection

Memory anomaly detection in Defender for Endpoint or CrowdStrike may flag the rapid sequential large allocation pattern as suspicious heap activity

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1203Exploitation for Client ExecutionT1055Process Injection

Same Tactic: Privilege Escalation

Popular Detections