Potential CVE-2021-40444 Exploitation Attempt
Detects potential exploitation of CVE-2021-40444, a Microsoft MSHTML Remote Code Execution vulnerability, by identifying suspicious process patterns. Specifically, it looks for 'control.exe' being spawned by Microsoft Office applications (Winword, Powerpnt, Excel) with command-line arguments that do not match known benign patterns for 'control.exe input.dll'. This behavior has been observed in in-the-wild exploitations of this vulnerability.
Sigma
