hightestEmerging Threat
Suspicious Word Cab File Write CVE-2021-40444
Detects file creation patterns noticeable during the exploitation of CVE-2021-40444
windowsfile_event
2023-06-22
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
hightestEmerging Threat
Potential CVE-2021-40444 Exploitation Attempt
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations
windowsprocess_creation
2023-02-04
hightestEmerging Threat
Potential Exploitation Attempt From Office Application
Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)
windowsprocess_creation
2023-02-04