APT28 CVE-2026-21509 Microsoft Office Security Bypass Exploitation

Daniel Jeremiah@daniyyell

•updated Feb 6, 2026•6•0•48

This rule detects potential exploitation of CVE-2026-21509, a Microsoft Office security bypass vulnerability. It specifically looks for Microsoft Office applications (Word, Excel, Outlook) spawning 'reg.exe', 'regsvr32.exe', 'cscript.exe', or 'wscript.exe' with command-line arguments indicative of COM object registration or manipulation, such as 'CLSID', 'InProcServer32', 'prnfldr', or 'DllInstall'.