CVE2017

CVE-2017-0261

1Rules

1References

1Folders

2021-11-27Latest

Summary

CVE-2017-0261 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2017. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threatmediumtest

Exploit for CVE-2017-0261

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

WindowsProcess Creation

TA0002 · ExecutionT1203 · Exploitation for Client ExecutionT1204.002 · Malicious FileTA0001 · Initial Access+3

Florian Roth (Nextron Systems)Thu Feb 222017

References

Resolving title…

fireeye.com