Shell.Explorer OLE Object Loading
Detects Sysmon Image Load events for shdocvw.dll or ieframe.dll by Office applications, which indicates the Shell.Explorer.1 or Internet Explorer component is being loaded. This is a direct indicator of CVE-2026-21509 exploitation as Office normally doesn't load these browser-related DLLs. The vulnerability specifically exploits the Shell.Explorer.1 COM object which relies on these DLLs for browser functionality within Office documents.
Sigma
