Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
9
3
2
1
Contributors
7
2
2
1
1
Categories
7
5
4
4
3
Platforms
13
1
Products / Services
10
2
1
1
1
MITRE Techniques
6
6
5
5
5
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
Detects outbound HTTP requests or TLS traffic to known C2 domains associated with APT28/UAC-0001 related to the CVE-2026-21509 campaign.
Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects the instantiation of the Shell.Explorer.1 COM object via OLE in RTF documents, which is indicative of an attempt to exploit CVE-2026-21509 (PRISMEX). This vulnerability allows for potential arbitrary code execution.
Detects abnormal child process creation from msdt.exe, diaghub.exe, diagtrack.exe, winword.exe, excel.exe, or outlook.exe. The child processes of interest include common scripting and system utilities such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, schtasks.exe, at.exe, net.exe, and net1.exe. This activity is commonly associated with Office/browser exploitation chains, specifically linked to APT28 exploiting CVE-2026-21509 and CVE-2026-21513 in Microsoft products.
This detection helps you spot activity linked to Pawn Storm PRISMEX (CVE-2026-21509 / CVE-2026-21513) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident notes and.
This rule detects Office applications (Word, Excel, PowerPoint) or Windows Explorer making outbound WebDAV connections to external, non-private IP addresses on standard web ports (80, 443). This behavior is associated with exploitation of vulnerabilities like CVE-2026-21509, potentially by threat actors such as APT28, to force authentication or exfiltrate data.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Microsoft disclosed CVE-2026-21509 an important vulnerability that allows attackers to bypass Office security protections when a user opens a malicious document (🔗 in the comments). Exploitation has already been observed in the wild.
This mainly affects Office 2016 and 2019, which are still widely used.
✅ How to reduce the risk:
- Install the January 2026 security updates for Office 2016 / 2019
- If patching is delayed, apply the recommended registry mitigation to block the vulnerable COM/OLE control. (Microsoft 365 Apps and newer Office versions are protected via service-side mitigations (restart required)
Even “non-critical” Office vulnerabilities matter — a single document can be enough to trigger an attack.
🚨Execute the following KQL query to detect the affected Version
This mainly affects Office 2016 and 2019, which are still widely used.
✅ How to reduce the risk:
- Install the January 2026 security updates for Office 2016 / 2019
- If patching is delayed, apply the recommended registry mitigation to block the vulnerable COM/OLE control. (Microsoft 365 Apps and newer Office versions are protected via service-side mitigations (restart required)
Even “non-critical” Office vulnerabilities matter — a single document can be enough to trigger an attack.
🚨Execute the following KQL query to detect the affected Version
Detects Sysmon Image Load events for shdocvw.dll or ieframe.dll by Office applications, which indicates the Shell.Explorer.1 or Internet Explorer component is being loaded. This is a direct indicator of CVE-2026-21509 exploitation as Office normally doesn't load these browser-related DLLs. The vulnerability specifically exploits the Shell.Explorer.1 COM object which relies on these DLLs for browser functionality within Office documents.
Detects network connections initiated by Microsoft Office applications that may indicate CVE-2026-21509 exploitation. The Shell.Explorer.1 embedded browser component can establish outbound connections to attacker-controlled servers without user awareness. This rule monitors for Office processes making HTTP/HTTPS connections, especially to non-Microsoft and non-CDN destinations.