Exploit for CVE-2017-8759 via WINWORD and csc.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•32

This rule detects the execution of 'csc.exe' as a sub-process of 'WINWORD.EXE'. This specific process relationship is indicative of exploitation attempts leveraging CVE-2017-8759, where a crafted document (opened by Winword) can lead to the execution of arbitrary code, often using csc.exe (C# compiler) to compile and execute malicious code on the fly.