Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
8
3
1
Contributors
8
3
1
Categories
9
6
2
2
1
Platforms
11
1
Products / Services
10
7
6
1
1
MITRE Techniques
7
5
4
4
3
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies instances of control.exe loading a .cpl or .inf file from a writable directory, which is related to CVE-2021-40444. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions mapped to the `Processes` node of the `Endpoint` data model. This activity is significant as it may indicate an attempt to exploit a known vulnerability, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to gain control over the affected system, leading to further compromise.
The following analytic identifies instances of rundll32.exe executing with `Control_RunDLL` in the command line, which is indicative of loading a .cpl or other file types. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as rundll32.exe can be exploited to execute malicious Control Panel Item files, potentially linked to CVE-2021-40444. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
This rule detects the delivery of a malicious document exploiting CVE-2021-40444, an MSHTML remote code execution vulnerability. It specifically looks for HTTP traffic containing a Word document (word/document.xml) with embedded relationships that include an HTTP reference, indicating an attempt to fetch remote content, which is characteristic of the exploit delivery mechanism.
The analytic detects Microsoft Office products writing `.cab` or `.inf` files, which is indicative of exploitation related to CVE-2021-40444. This activity may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector that can lead to remote code execution and system compromise.
The analytic identifies instances of `control.exe` loading a `.cpl` or `.inf` file from a world-writable directory (e.g., `appdata`, `windows\temp`, `programdata`). This activity is often associated with attempts to exploit vulnerabilities like CVE-2021-40444, which could lead to unauthorized code execution and system compromise. The detection leverages process names and command-line executions from EDR agents.
The analytic identifies instances of rundll32.exe executing with `Control_RunDLL` in the command line, which is indicative of loading a .cpl or other file types. This activity is significant as rundll32.exe can be exploited to execute malicious Control Panel Item files, potentially linked to CVE-2021-40444. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
The analytic identifies instances where `control.exe` is spawned by a Microsoft Office product. This activity can indicate exploitation attempts, specifically related to CVE-2021-40444, where `control.exe` is used to execute malicious .cpl or .inf files. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
The analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration.
The following analytic detects the execution of rundll32.exe with the `Control_RunDLL` command, loading files from world-writable directories such as windows\temp, programdata, or appdata. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process command-line data and specific directory paths. This activity is significant as it may indicate an attempt to exploit CVE-2021-40444 or similar vulnerabilities, allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment.
Detects file creation patterns indicative of the CVE-2021-40444 exploit, specifically the creation of CAB and INF files by Microsoft Word in temporary internet cache or local temporary directories.
Detects Microsoft Office applications executing child processes that include directory traversal patterns in their command line. This behavior is indicative of exploitation attempts, specifically referencing vulnerabilities like CVE-2022-30190 (MSDT RCE, also known as Follina) and CVE-2021-40444 (MSHTML RCE). The rule looks for common Office applications as parent processes and specific directory traversal strings in the child process's command line.
Detects potential exploitation of CVE-2021-40444, a Microsoft MSHTML Remote Code Execution vulnerability, by identifying suspicious process patterns. Specifically, it looks for 'control.exe' being spawned by Microsoft Office applications (Winword, Powerpnt, Excel) with command-line arguments that do not match known benign patterns for 'control.exe input.dll'. This behavior has been observed in in-the-wild exploitations of this vulnerability.