Suspicious Word Cab File Write CVE-2021-40444

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects file creation patterns indicative of the CVE-2021-40444 exploit, specifically the creation of CAB and INF files by Microsoft Word in temporary internet cache or local temporary directories.