Exploit for CVE-2017-0261 via Winword Spawning FLTLDR.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

Detects Microsoft Word (WINWORD.EXE) starting the uncommon sub-process FLTLDR.exe, which is indicative of exploitation attempts for vulnerabilities like CVE-2017-0261 and CVE-2017-0262. This behavior suggests a malicious document is attempting to execute arbitrary code.