Windows: Winword launches FLTLDR.exe for CVE-2017-0261 style exploitation

Alerts when Winword spawns a FLTLDR.exe child process, matching a CVE-2017-0261-style exploit chain.

FreeUnreviewedSigmamediumv1

windows-winword-launches-fltldr-exe-for-cve-2017-0261-style-exploitation-864403a1

title: "Windows: Winword launches FLTLDR.exe for CVE-2017-0261 style exploitation"
id: b7c90bfd-17c3-4245-a9ff-13a2cdd2092a
status: test
description: This rule flags process creation where WINWORD.EXE starts a child process containing FLTLDR.exe, a pattern used in exploitation chains for CVE-2017-0261 and CVE-2017-0262. Attackers can use Word to launch these staged binaries to run malicious code and establish initial footholds. The detection relies on Windows process creation telemetry, specifically parent and image path matching.
references:
  - https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-0261/proc_creation_win_exploit_cve_2017_0261.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-22
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.initial-access
  - attack.t1566.001
  - cve.2017-0261
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WINWORD.EXE
    Image|contains: \FLTLDR.exe
  condition: selection
falsepositives:
  - Several false positives identified, check for suspicious file names or locations (e.g. Temp folders)
level: medium
license: DRL-1.1
related:
  - id: 864403a1-36c9-40a2-a982-4c9a45f7d833
    type: derived

What it detects

This rule flags process creation where WINWORD.EXE starts a child process containing FLTLDR.exe, a pattern used in exploitation chains for CVE-2017-0261 and CVE-2017-0262. Attackers can use Word to launch these staged binaries to run malicious code and establish initial footholds. The detection relies on Windows process creation telemetry, specifically parent and image path matching.

Known false positives

Several false positives identified, check for suspicious file names or locations (e.g. Temp folders)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.