Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern

Alerts when control.exe is launched from Office apps with suspicious DLL-related command lines, consistent with CVE-2021-40444 exploitation attempts.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), @neonprimetime (SigmaHQ), DRL 1.1
Published: 2021-09-08
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags suspicious process creation where control.exe is launched by Microsoft Office applications (winword.exe, powerpnt.exe, excel.exe) based on matching process name endings. Such behavior matters because control.exe can be abused for code execution paths during Office-driven exploitation attempts. The detection relies on process creation telemetry including Image, ParentImage, and CommandLine endings to suppress a known benign invocation pattern.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Suspicious OneNote Spawning Command or Script Interpreter via Spear-Phishing (via process_creation)

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

Suspicious VMware Guest Operation Output Staging in vmware-system Temp Directory (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

Suspicious AutoHotkey Script Execution from User Writable Path by DarkGate

Malicious China Chopper Web Shell Command Pattern in IIS Worker Process (via process_creation)

Malicious AutoHotKey Runner AutoNotify Executing AHKBot Looper Script (via process_creation)

Malicious IIS Worker Process Spawning Command Shell after ASP.NET ViewState Injection (via process_creation)

Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern

Pivot detection · T1059 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cve-2021-40444-control-exe-and-office-parent-process-exploitation-attemp-894397c6

title: Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern
id: fd7b3eaf-fc29-4d8a-891b-bee476fc3ff7
status: test
description: This rule flags suspicious process creation where control.exe is launched by Microsoft Office applications (winword.exe, powerpnt.exe, excel.exe) based on matching process name endings. Such behavior matters because control.exe can be abused for code execution paths during Office-driven exploitation attempts. The detection relies on process creation telemetry including Image, ParentImage, and CommandLine endings to suppress a known benign invocation pattern.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://twitter.com/neonprimetime/status/1435584010202255375
  - https://www.joesandbox.com/analysis/476188/1/iochtml
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
author: Florian Roth (Nextron Systems), @neonprimetime, Huntrule Team
date: 2021-09-08
modified: 2023-02-04
tags:
  - attack.execution
  - attack.t1059
  - cve.2021-40444
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \control.exe
    ParentImage|endswith:
      - \winword.exe
      - \powerpnt.exe
      - \excel.exe
  filter:
    CommandLine|endswith:
      - \control.exe input.dll
      - \control.exe" input.dll
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 894397c6-da03-425c-a589-3d09e7d1f750
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL