Exploit for CVE-2015-1641 via MicroScMgmt.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of 'MicroScMgmt.exe' as a sub-process of 'WINWORD.EXE', which is indicative of an exploit for CVE-2015-1641. This specific process creation pattern has been observed in attacks leveraging this vulnerability.