Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern

Alerts when control.exe is launched from Office apps with suspicious DLL-related command lines, consistent with CVE-2021-40444 exploitation attempts.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), @neonprimetime (SigmaHQ), DRL 1.1
Published
2021-09-08
Updated
2026-07-31
title: Windows Process Execution of control.exe Spawned by Office Apps Matching CVE-2021-40444 Pattern
id: fd7b3eaf-fc29-4d8a-891b-bee476fc3ff7
status: test
description: This rule flags suspicious process creation where control.exe is launched by Microsoft Office applications (winword.exe, powerpnt.exe, excel.exe) based on matching process name endings. Such behavior matters because control.exe can be abused for code execution paths during Office-driven exploitation attempts. The detection relies on process creation telemetry including Image, ParentImage, and CommandLine endings to suppress a known benign invocation pattern.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://twitter.com/neonprimetime/status/1435584010202255375
  - https://www.joesandbox.com/analysis/476188/1/iochtml
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
author: Florian Roth (Nextron Systems), @neonprimetime, Huntrule Team
date: 2021-09-08
modified: 2023-02-04
tags:
  - attack.execution
  - attack.t1059
  - cve.2021-40444
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \control.exe
    ParentImage|endswith:
      - \winword.exe
      - \powerpnt.exe
      - \excel.exe
  filter:
    CommandLine|endswith:
      - \control.exe input.dll
      - \control.exe" input.dll
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 894397c6-da03-425c-a589-3d09e7d1f750
    type: derived