Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Alerts when Winword spawns a FLTLDR.exe child process, matching a CVE-2017-0261-style exploit chain.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-02-22
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
- T1203Exploitation for Client Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags instances where WINWORD.EXE spawns a process containing FLTLDR.exe in the executable path. Such a parent/child pairing is consistent with document-based exploitation activity targeting CVE-2017-0261/0262. It relies on Windows process creation telemetry, matching on the parent image name and the child image path content.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Malicious Equation Editor Child Process Indicating Exploit

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious DLL Written to Explorer IconCache Path

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern

Windows: Suspicious subprocess execution from Hwp.exe spawning gbb.exe

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Pivot detection · T1566.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winword-launches-fltldr-exe-for-cve-2017-0261-style-exploitation-864403a1

title: "Windows process creation: Winword launching FLTLDR.exe exploitation behavior"
id: b7c90bfd-17c3-4245-a9ff-13a2cdd2092a
status: test
description: This rule flags instances where WINWORD.EXE spawns a process containing FLTLDR.exe in the executable path. Such a parent/child pairing is consistent with document-based exploitation activity targeting CVE-2017-0261/0262. It relies on Windows process creation telemetry, matching on the parent image name and the child image path content.
references:
  - https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-0261/proc_creation_win_exploit_cve_2017_0261.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-22
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.initial-access
  - attack.t1566.001
  - cve.2017-0261
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WINWORD.EXE
    Image|contains: \FLTLDR.exe
  condition: selection
falsepositives:
  - Several false positives identified, check for suspicious file names or locations (e.g. Temp folders)
level: medium
license: DRL-1.1
related:
  - id: 864403a1-36c9-40a2-a982-4c9a45f7d833
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL