Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern
Alerts when control.exe is launched from Office apps with suspicious DLL-related command lines, consistent with CVE-2021-40444 exploitation attempts.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), @neonprimetime (SigmaHQ), DRL 1.1
- Published
- 2021-09-08
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags suspicious process creation where control.exe is launched by Microsoft Office applications (winword.exe, powerpnt.exe, excel.exe) based on matching process name endings. Such behavior matters because control.exe can be abused for code execution paths during Office-driven exploitation attempts. The detection relies on process creation telemetry including Image, ParentImage, and CommandLine endings to suppress a known benign invocation pattern.
Reporting behind it
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- twitter.comhttps://twitter.com/neonprimetime/status/1435584010202255375
- joesandbox.comhttps://www.joesandbox.com/analysis/476188/1/iochtml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern
id: fd7b3eaf-fc29-4d8a-891b-bee476fc3ff7
status: test
description: This rule flags suspicious process creation where control.exe is launched by Microsoft Office applications (winword.exe, powerpnt.exe, excel.exe) based on matching process name endings. Such behavior matters because control.exe can be abused for code execution paths during Office-driven exploitation attempts. The detection relies on process creation telemetry including Image, ParentImage, and CommandLine endings to suppress a known benign invocation pattern.
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://twitter.com/neonprimetime/status/1435584010202255375
- https://www.joesandbox.com/analysis/476188/1/iochtml
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
author: Florian Roth (Nextron Systems), @neonprimetime, Huntrule Team
date: 2021-09-08
modified: 2023-02-04
tags:
- attack.execution
- attack.t1059
- cve.2021-40444
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \control.exe
ParentImage|endswith:
- \winword.exe
- \powerpnt.exe
- \excel.exe
filter:
CommandLine|endswith:
- \control.exe input.dll
- \control.exe" input.dll
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 894397c6-da03-425c-a589-3d09e7d1f750
type: derived