Windows: Winword launching MicroScMgmt.exe for CVE-2015-1641 exploitation

Alerts when Winword.exe starts MicroScMgmt.exe, matching a known CVE-2015-1641 exploitation behavior.

FreeUnreviewedSigmacriticalv1

windows-winword-launching-microscmgmt-exe-for-cve-2015-1641-exploitation-7993792c

title: "Windows: Winword launching MicroScMgmt.exe for CVE-2015-1641 exploitation"
id: dd74baf1-ada8-427f-9080-28844e2394d4
status: stable
description: This rule identifies process creation where WINWORD.EXE spawns MicroScMgmt.exe, a parent/child pairing associated with exploitation of CVE-2015-1641. Attackers may use this behavior to execute malicious components from within Office to carry out the exploit chain. It relies on Windows process creation telemetry, matching the process image paths by their executable names.
references:
  - https://www.virustotal.com/en/file/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8/analysis/
  - https://www.hybrid-analysis.com/sample/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-22
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1036.005
  - cve.2015-1641
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WINWORD.EXE
    Image|endswith: \MicroScMgmt.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 7993792c-5ce2-4475-a3db-a3a5539827ef
    type: derived

What it detects

This rule identifies process creation where WINWORD.EXE spawns MicroScMgmt.exe, a parent/child pairing associated with exploitation of CVE-2015-1641. Attackers may use this behavior to execute malicious components from within Office to carry out the exploit chain. It relies on Windows process creation telemetry, matching the process image paths by their executable names.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.