
title: CVE-2021-40444 Process Pattern
author: '@neonprimetime, Florian Roth'
date: 2021/09/08
description: Detects a suspicious process pattern found in CVE-2021-40444 exploitation
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\control.exe'
  SELECTION_3:
    ParentImage:
    - '*\winword.exe'
    - '*\powerpnt.exe'
    - '*\excel.exe'
  SELECTION_4:
    CommandLine: '*\control.exe input.dll'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- Unknown
id: 894397c6-da03-425c-a589-3d09e7d1f750
level: critical
logsource:
  category: process_creation
  product: windows
modified: 2021/09/09
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://twitter.com/neonprimetime/status/1435584010202255375
- https://www.joesandbox.com/analysis/476188/1/iochtml
status: experimental
tags:
- attack.execution
- attack.t1059
ruletype: SIGMA
