Windows Winword Creates INetCache CAB and Temp INF Files

Flags winword.exe writing CABs in INetCache or INF files in Temp consistent with CVE-2021-40444 exploitation.

FreeUnreviewedSigmahighv1

windows-winword-creates-inetcache-cab-and-temp-inf-files-60c0a111

title: Windows Winword Creates INetCache CAB and Temp INF Files
id: a88f0ba1-b2fc-47e3-a46d-000884918119
status: test
description: This rule identifies suspicious file creation where winword.exe writes .cab files located under the \\Windows\\INetCache directory. It also flags winword.exe creating .inf files in \\AppData\\Local\\Temp, patterns commonly seen during exploitation of CVE-2021-40444. The detection relies on Windows file event telemetry capturing the writing process image path and target filename.
references:
  - https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
  - https://twitter.com/vanitasnk/status/1437329511142420483?s=21
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/file_event_win_exploit_cve_2021_40444.yml
author: Florian Roth (Nextron Systems), Sittikorn S, Huntrule Team
date: 2021-09-10
modified: 2023-06-22
tags:
  - attack.resource-development
  - attack.t1587
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection_cab:
    Image|endswith: \winword.exe
    TargetFilename|contains: \Windows\INetCache
    TargetFilename|endswith: .cab
  selection_inf:
    Image|endswith: \winword.exe
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - ".inf"
  filter_main_legit:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: AppData\Local\Temp
    TargetFilename|endswith: \Content.inf
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 60c0a111-787a-4e8a-9262-ee485f3ef9d5
    type: derived

What it detects

This rule identifies suspicious file creation where winword.exe writes .cab files located under the \\Windows\\INetCache directory. It also flags winword.exe creating .inf files in \\AppData\\Local\\Temp, patterns commonly seen during exploitation of CVE-2021-40444. The detection relies on Windows file event telemetry capturing the writing process image path and target filename.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.