Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation

Flags winword.exe writing CABs in INetCache or INF files in Temp consistent with CVE-2021-40444 exploitation.

FreeReviewedSigma · High · v5
Product
windows
Category
file_event
Author
Florian Roth (Nextron Systems), Sittikorn S (SigmaHQ), DRL 1.1
Published
2021-09-10
Updated
2026-07-31
title: Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation
id: a88f0ba1-b2fc-47e3-a46d-000884918119
status: test
description: This rule flags Windows file creation activity where winword.exe writes a .cab file into the INetCache directory or creates a .inf file under AppData\Local\Temp. Such patterns can indicate document-triggered payload staging, where attacker-controlled files are dropped to transient locations for follow-on execution. It relies on file event telemetry capturing the process image path and the created target filename, including directory and extension details.
references:
  - https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
  - https://twitter.com/vanitasnk/status/1437329511142420483?s=21
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/file_event_win_exploit_cve_2021_40444.yml
author: Florian Roth (Nextron Systems), Sittikorn S, Huntrule Team
date: 2021-09-10
modified: 2023-06-22
tags:
  - attack.resource-development
  - attack.t1587
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection_cab:
    Image|endswith: \winword.exe
    TargetFilename|contains: \Windows\INetCache
    TargetFilename|endswith: .cab
  selection_inf:
    Image|endswith: \winword.exe
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - ".inf"
  filter_main_legit:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: AppData\Local\Temp
    TargetFilename|endswith: \Content.inf
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 60c0a111-787a-4e8a-9262-ee485f3ef9d5
    type: derived