Windows CVE-2021-40444 Control.exe and Office Parent Process Exploitation Attempts

Alerts when control.exe is launched from Office apps with suspicious DLL-related command lines, consistent with CVE-2021-40444 exploitation attempts.

FreeUnreviewedSigmahighv1

windows-cve-2021-40444-control-exe-and-office-parent-process-exploitation-attemp-894397c6

title: Windows CVE-2021-40444 Control.exe and Office Parent Process Exploitation Attempts
id: fd7b3eaf-fc29-4d8a-891b-bee476fc3ff7
status: test
description: This rule flags potential attempts to exploit CVE-2021-40444 by observing a specific control.exe process spawning from Office applications. Attackers commonly leverage Office parent processes to launch control.exe with an external DLL payload, so this process-chain is a useful indicator of malicious execution. It relies on Windows process creation telemetry, including executable paths and command-line endings, and matches cases where control.exe is launched from winword.exe, powerpnt.exe, or excel.exe while not matching the specific benign-looking command-line suffix patterns in the filter.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://twitter.com/neonprimetime/status/1435584010202255375
  - https://www.joesandbox.com/analysis/476188/1/iochtml
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
author: Florian Roth (Nextron Systems), @neonprimetime, Huntrule Team
date: 2021-09-08
modified: 2023-02-04
tags:
  - attack.execution
  - attack.t1059
  - cve.2021-40444
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \control.exe
    ParentImage|endswith:
      - \winword.exe
      - \powerpnt.exe
      - \excel.exe
  filter:
    CommandLine|endswith:
      - \control.exe input.dll
      - \control.exe" input.dll
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 894397c6-da03-425c-a589-3d09e7d1f750
    type: derived

What it detects

This rule flags potential attempts to exploit CVE-2021-40444 by observing a specific control.exe process spawning from Office applications. Attackers commonly leverage Office parent processes to launch control.exe with an external DLL payload, so this process-chain is a useful indicator of malicious execution. It relies on Windows process creation telemetry, including executable paths and command-line endings, and matches cases where control.exe is launched from winword.exe, powerpnt.exe, or excel.exe while not matching the specific benign-looking command-line suffix patterns in the filter.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.