Emerging Threatcriticalstable

Exploit for CVE-2015-1641

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Thu Feb 22Updated Sat Nov 277993792c-5ce2-4475-a3db-a3a5539827ef2015

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\WINWORD.EXE'
        Image|endswith: '\MicroScMgmt.exe'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1036.005 · Match Legitimate Name or Location

Other

cve.2015-1641detection.emerging-threats

Rule Metadata

Rule ID

7993792c-5ce2-4475-a3db-a3a5539827ef

Status

stable

Level

critical

Type

Emerging Threat

Created

Thu Feb 22

Modified

Sat Nov 27

Author

Florian Roth (Nextron Systems)

Path

rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml

Raw Tags

attack.defense-evasionattack.t1036.005cve.2015-1641detection.emerging-threats

View on GitHub