ATT&CK T1203 - CVE-2021-40444 MSHTML Exploit Delivery

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects the delivery of a malicious document exploiting CVE-2021-40444, an MSHTML remote code execution vulnerability. It specifically looks for HTTP traffic containing a Word document (word/document.xml) with embedded relationships that include an HTTP reference, indicating an attempt to fetch remote content, which is characteristic of the exploit delivery mechanism.