mediumtestEmerging Threat
Exploit for CVE-2017-0261
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262
windowsprocess_creation
2021-11-27
Emerging Threats
CVE2017
CVE-2017-0261
1Rules
1References
1Folders
2021-11-27Latest
Summary
CVE-2017-0261 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2017. Coverage centers on windows / process_creation.
Related Detections
Search this threatReferences