CVE-2025-62221 Elastic Security · Elastic

Detect CVE-2025-62221 Microsoft Windows Use After Free Exploitation in Elastic Security

Detects exploitation attempts of CVE-2025-62221, a use-after-free vulnerability in Microsoft Windows. This class of memory corruption flaw allows attackers to execute arbitrary code by manipulating freed memory objects. As a CISA KEV entry, active exploitation in the wild has been confirmed. Detection focuses on anomalous process behavior, kernel-mode memory corruption indicators, crash telemetry, and privilege escalation patterns consistent with UAF exploitation chains.

MITRE ATT&CK

Tactic
Privilege Escalation Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [process where event.action == "start" and
   process.parent.name in ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe") and
   not process.name in ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "svchost.exe",
                        "conhost.exe", "WerFault.exe", "wermgr.exe")]
  [any where event.category == "process" and
   (process.token.integrity_level_name == "high" or process.token.integrity_level_name == "system") and
   user.name != "SYSTEM" and user.name != "LOCAL SERVICE" and user.name != "NETWORK SERVICE"]
critical severity medium confidence

EQL sequence detection correlating anomalous child process creation from Windows system processes followed by elevated token acquisition, indicative of CVE-2025-62221 UAF privilege escalation.

Data Sources

Elastic EndpointWindows Event Log via Elastic Agent

Required Tables

logs-endpoint.events.process-*winlogbeat-*

False Positives & Tuning

  • Windows Update processes spawning child utilities from svchost.exe during patch cycles
  • System management frameworks like SCCM or Intune spawning agents from service parents
  • Security software performing token inspection or integrity level checks as part of normal operations

Other platforms for CVE-2025-62221

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate UAF-style anomalous child process from lsass.exe parent (lab only)

    Expected signal: Sysmon Event ID 1 with ParentImage pointing to lsass.exe and Image of cmd.exe; Windows Security EventID 4688 with anomalous parent-child relationship

  2. Test 2WER crash trigger on system process to simulate pre-exploit crash artifacts

    Expected signal: Windows Event ID 1000 (Application Error) and 1001 (Windows Error Reporting) in Application event log; WER report created in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue

  3. Test 3Elevated token process launch from spoofed system parent context

    Expected signal: Sysmon Event ID 1 showing cmd.exe with IntegrityLevel=System spawned by psexec service; Windows Security EventID 4688 with elevated token; EventID 4672 (special privileges assigned to new logon)

  4. Test 4Heap spray pattern simulation via PowerShell memory allocation

    Expected signal: PowerShell Script Block Logging (EventID 4104) capturing the allocation loop; potential AMSI or Defender behavioral alert on large sequential memory allocation patterns

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Verify the affected host's patch level against Microsoft's December 2025 Patch Tuesday updates; confirm whether the CVE-2025-62221 patch has been applied via 'wmic qfe list' or Windows Update history
  2. Review the alerting process's full ancestry tree — identify which Windows system process is the immediate parent and trace back to the root initiating process or user session
  3. Examine process memory characteristics using Defender ATP advanced hunting or CrowdStrike process tree: look for indicators of heap spray, ROP gadgets, or unusual shellcode regions in adjacent process memory
  4. Correlate the event time with network connections from the affected host — use DeviceNetworkEvents or equivalent to identify any C2 beaconing or lateral movement immediately after the anomalous process launch
  5. Check for newly created files, registry run keys, or scheduled tasks created within 5 minutes of the suspicious process activity that may indicate persistence establishment post-exploitation

Containment

  1. Isolate the affected host from the network immediately using EDR isolation capability (CrowdStrike Network Contain or Defender for Endpoint device isolation) to prevent lateral movement or C2 communication
  2. Terminate the suspicious child process and any descendant processes it may have spawned, then preserve a memory dump of the parent system process for forensic analysis before any remediation
  3. Revoke any authentication tokens or Kerberos tickets associated with the compromised user session and force re-authentication from a clean endpoint

Evidence Collection

  1. Collect a full memory dump of the affected Windows system process (lsass, csrss, etc.) and the suspicious child process using WinPmem or via EDR memory acquisition for offline heap/UAF analysis
  2. Export Windows Security Event logs (EventIDs 4624, 4625, 4688, 4672, 4673), Sysmon logs, and PowerShell operational logs from the affected host covering at least 2 hours before and after the detection trigger
  3. Capture network packet capture (PCAP) from the host or nearest network tap covering the exploitation window to identify payload delivery mechanism and any post-exploitation C2 traffic

Escalation Criteria

  • !Escalate immediately if the process spawned from lsass.exe, csrss.exe, or winlogon.exe gains SYSTEM-level privileges, accesses credential stores, or initiates lateral movement via SMB, WMI, or RDP
  • !Escalate to incident response team if the same CVE-2025-62221 pattern is observed across more than two hosts within a 1-hour window, indicating active campaign or worm-like spreading behavior

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Windows Error Reporting (WER) crash dumps in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue — UAF exploitation often generates crash artifacts before successful exploitation
  • >Prefetch files for any unusual executables spawned from system processes (C:\Windows\Prefetch\*.pf)
  • >Windows Event Log entries: EventID 7031/7034 (Service crashed), EventID 1000/1001 (Application Error/Fault Bucket), and EventID 4688 (Process Create) correlating with exploitation time
  • >Memory forensics: heap structures showing freed object reuse patterns in affected Windows process memory pages using Volatility or WinDbg with !heap -a

Tuning Guidance

Start with high-confidence process ancestry rules and tune out known-good parent-child pairs specific to your environment's management tooling (e.g., SCCM, Intune, CrowdStrike, Defender). Whitelist by hash or signed binary path rather than process name alone to prevent evasion via renamed binaries. Increase confidence thresholds by correlating process anomalies with concurrent crash events (WER) or network connections from the same host. For environments with heavy automation, consider time-boxing detection to off-hours or correlating with user login sessions to reduce alert volume. Once the specific vulnerable Windows component is publicly identified, narrow the query to target that component's process name directly.

Hunting Queries

Threat hunt for repeated crashes in Windows system processes that may indicate failed UAF exploitation attempts (spray-and-pray) preceding a successful CVE-2025-62221 exploit. Repeated crashes of system processes are a strong pre-exploitation indicator.

Hunting — KQL
kql 
DeviceCrashEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("lsass.exe", "csrss.exe", "winlogon.exe", "svchost.exe")
| summarize crash_count=count(), first_crash=min(Timestamp), last_crash=max(Timestamp) by DeviceName, FileName, FaultingModuleName
| where crash_count >= 2
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp >= ago(7d)
    | where InitiatingProcessFileName in~ ("lsass.exe", "csrss.exe", "winlogon.exe", "svchost.exe")
    | summarize anomalous_spawns=count() by DeviceName, InitiatingProcessFileName
) on DeviceName
| project DeviceName, FileName, FaultingModuleName, crash_count, anomalous_spawns, first_crash, last_crash
Hunting — SPL
spl 
index=windows (EventCode=1000 OR EventCode=1001 OR EventCode=7031 OR EventCode=7034)
| eval affected_process=coalesce(param1, ProcessName)
| where affected_process IN ("lsass.exe", "csrss.exe", "winlogon.exe", "svchost.exe", "services.exe")
| stats count as crash_events min(_time) as first_seen max(_time) as last_seen by host, affected_process, EventCode
| where crash_events >= 2
| sort - crash_events

Atomic Red Team Tests

Test 1 Simulate UAF-style anomalous child process from lsass.exe parent (lab only)
windows

Uses a test harness to spawn a cmd.exe child process appearing to originate from lsass.exe by manipulating parent process ID via NtCreateUserProcess, simulating the process ancestry pattern seen in UAF exploitation.

Command

powershell 
# Requires Atomic Red Team or custom parent-spoofing tool
# Example using SelectMyParent (lab tool):
# SelectMyParent.exe cmd.exe <PID_OF_LSASS>
$lsassPid = (Get-Process lsass).Id
Write-Host "LSASS PID: $lsassPid"
# In lab: inject or use parent-spoof tool targeting this PID
# DO NOT run on production systems

Cleanup

powershell 
Stop-Process -Name cmd -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with ParentImage pointing to lsass.exe and Image of cmd.exe; Windows Security EventID 4688 with anomalous parent-child relationship

Expected Detection

KQL DeviceProcessEvents and Sysmon SPL queries should trigger on the anomalous parent-child process relationship within 60 seconds

Test 2 WER crash trigger on system process to simulate pre-exploit crash artifacts
windows

Forces a non-critical test process crash to generate WER artifacts similar to those produced during failed UAF exploitation spray attempts against Windows system components.

Command

powershell 
# Create a simple C program that crashes via use-after-free in user space (lab)
# For testing purposes, use NotMyFault from Sysinternals to trigger a controlled crash:
# notmyfault.exe /crash  (requires kernel driver — lab only)
# Simpler: trigger access violation in test process
$code = @'
#include <windows.h>
int main() { int* p = (int*)malloc(4); free(p); *p = 42; return 0; }
'@
$code | Out-File -FilePath C:\Temp\uaf_test.c -Encoding ASCII
Write-Host "Compile and run uaf_test.c in lab environment to generate WER artifacts"

Cleanup

powershell 
Remove-Item C:\Temp\uaf_test.c -Force -ErrorAction SilentlyContinue; Get-ChildItem $env:LOCALAPPDATA\Microsoft\Windows\WER\ReportQueue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddMinutes(-5)} | Remove-Item -Recurse -Force

Expected Telemetry

Windows Event ID 1000 (Application Error) and 1001 (Windows Error Reporting) in Application event log; WER report created in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue

Expected Detection

Hunting query for repeated crash events on system processes should surface this within the crash correlation window

Test 3 Elevated token process launch from spoofed system parent context
windows

Tests detection of a high-integrity process launch that appears to originate from a Windows system process, simulating the privilege escalation outcome of successful CVE-2025-62221 exploitation.

Command

powershell 
# Using Token Impersonation test (lab — requires local admin)
# PsExec to simulate SYSTEM context child process:
psexec.exe -s -i cmd.exe /c whoami > C:\Temp\uaf_test_output.txt
type C:\Temp\uaf_test_output.txt

Cleanup

powershell 
Remove-Item C:\Temp\uaf_test_output.txt -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe with IntegrityLevel=System spawned by psexec service; Windows Security EventID 4688 with elevated token; EventID 4672 (special privileges assigned to new logon)

Expected Detection

CrowdStrike CQL query on TokenIsElevated=1 with system-process parent should alert; KQL DeviceProcessEvents integrity level correlation should trigger within detection window

Test 4 Heap spray pattern simulation via PowerShell memory allocation
windows

Simulates heap spray memory patterns often used in conjunction with UAF exploits to position controlled data in freed memory regions, generating telemetry detectable by memory protection systems.

Command

powershell 
# Lab-only heap spray simulation — no shellcode, benign allocation pattern
$heapSpraySize = 100MB
$allocations = New-Object System.Collections.ArrayList
for ($i = 0; $i -lt 100; $i++) {
    $buf = New-Object byte[] (1MB)
    [Array]::Fill($buf, [byte]0x41)  # Fill with 'A' — benign marker
    $allocations.Add($buf) | Out-Null
}
Write-Host "Allocated $($allocations.Count) 1MB buffers — heap spray pattern simulated"
Start-Sleep -Seconds 5
$allocations.Clear()
[System.GC]::Collect()

Cleanup

powershell 
[System.GC]::Collect(); Write-Host 'Memory released'

Expected Telemetry

PowerShell Script Block Logging (EventID 4104) capturing the allocation loop; potential AMSI or Defender behavioral alert on large sequential memory allocation patterns

Expected Detection

Memory anomaly detection in Defender for Endpoint or CrowdStrike may flag the rapid sequential large allocation pattern as suspicious heap activity

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1203Exploitation for Client ExecutionT1055Process Injection

Same Tactic: Privilege Escalation

Popular Detections