CVE-2026-21509 - Office Application Network Connection to Suspicious Destination
Detects network connections initiated by Microsoft Office applications that may indicate CVE-2026-21509 exploitation. The Shell.Explorer.1 embedded browser component can establish outbound connections to attacker-controlled servers without user awareness. This rule monitors for Office processes making HTTP/HTTPS connections, especially to non-Microsoft and non-CDN destinations.
Sigma
