Windows Office Child Process with Directory Traversal Patterns
Alerts on Office parent processes launching child commands containing directory traversal patterns.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Christian Burkard (Nextron Systems), @SBousseaden (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
What it detects
Identifies Windows Office applications (WinWord, Excel, PowerPoint, Access, Publisher, Equation Editor, Visio) spawning a child process whose command line contains directory traversal sequences. This behavior can indicate an attempt to access or manipulate files outside an intended directory, often used to support exploitation workflows. The rule relies on process creation telemetry, specifically parent image and the child process command line content.
Reporting behind it
- twitter.comhttps://twitter.com/sbousseaden/status/1531653369546301440
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444_office_directory_traversal.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-office-applications-spawning-child-processes-with-directory-traversal-st-868955d9
title: Windows Office Child Process with Directory Traversal Patterns
id: 0e429bef-0831-419c-9369-afceafb88013
status: test
description: Identifies Windows Office applications (WinWord, Excel, PowerPoint, Access, Publisher, Equation Editor, Visio) spawning a child process whose command line contains directory traversal sequences. This behavior can indicate an attempt to access or manipulate files outside an intended directory, often used to support exploitation workflows. The rule relies on process creation telemetry, specifically parent image and the child process command line content.
references:
- https://twitter.com/sbousseaden/status/1531653369546301440
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444_office_directory_traversal.yml
author: Christian Burkard (Nextron Systems), @SBousseaden (idea), Huntrule Team
date: 2022-06-02
modified: 2023-02-04
tags:
- attack.execution
- cve.2021-40444
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith:
- \winword.exe
- \excel.exe
- \powerpnt.exe
- \msaccess.exe
- \mspub.exe
- \eqnedt32.exe
- \visio.exe
CommandLine|contains:
- ../../../..
- ..\..\..\..
- ..//..//..//..
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 868955d9-697e-45d4-a3da-360cefd7c216
type: derived