WinWord spawning MicroScMgmt.exe indicative of CVE-2015-1641 exploitation on Windows

Alerts when Winword.exe starts MicroScMgmt.exe, matching a known CVE-2015-1641 exploitation behavior.

FreeReviewedSigma · Critical · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-02-22
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.005Match Legitimate Resource Name or Location
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where WINWORD.EXE launches MicroScMgmt.exe, a behavior observed in exploits for CVE-2015-1641. Attackers may use this execution path to run follow-on components from within the Office context. It relies on Windows process creation telemetry capturing parent and child process executable paths.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange

Scheduled Task Masquerading as Microsoft Wininet Config

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

Suspicious svchost.exe Execution From AppData Roaming Directory

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Malicious WezRat Persistence via Chrome Updater Run Key

Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory

Suspicious Execution of spools.exe from Public Directory

WinWord spawning MicroScMgmt.exe indicative of CVE-2015-1641 exploitation on Windows

Pivot detection · T1036.005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winword-launching-microscmgmt-exe-for-cve-2015-1641-exploitation-7993792c

title: WinWord spawning MicroScMgmt.exe indicative of CVE-2015-1641 exploitation on Windows
id: dd74baf1-ada8-427f-9080-28844e2394d4
status: stable
description: This rule identifies process creation where WINWORD.EXE launches MicroScMgmt.exe, a behavior observed in exploits for CVE-2015-1641. Attackers may use this execution path to run follow-on components from within the Office context. It relies on Windows process creation telemetry capturing parent and child process executable paths.
references:
  - https://www.virustotal.com/en/file/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8/analysis/
  - https://www.hybrid-analysis.com/sample/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-22
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1036.005
  - cve.2015-1641
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WINWORD.EXE
    Image|endswith: \MicroScMgmt.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 7993792c-5ce2-4475-a3db-a3a5539827ef
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL