Microsoft Patches Actively Exploited CVE-2021-40444
Microsoft released fixes for multiple vulnerabilities including CVE-2021-40444, an MSHTML flaw already exploited in the wild, and IPA urges urgent patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-40444 as exploited in the wild.
Japan's IPA issued an alert on September 15, 2021, following Microsoft's monthly security update, which addresses multiple vulnerabilities in Microsoft products. Exploitation of these flaws could cause application crashes or allow attackers to gain control of affected systems.
Of particular concern is CVE-2021-40444, a vulnerability in the MSHTML component that Microsoft confirmed had already been exploited in the wild. IPA had previously issued an emergency advisory on September 8, 2021 regarding this specific flaw prior to the patch's availability. Given the confirmed active exploitation and potential for expanded attacks, IPA is urging all users and organizations to apply the Microsoft patches immediately via Windows Update.
Mentioned in this report
Detection guidance
Office Application Spawning Suspicious Child Process (Possible CVE-2021-40444 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command interpreters or system utilities, consistent with exploitation of the MSHTML CVE-2021-40444 vulnerability via malicious document. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Suspicious Child Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\WINWORD.EXE
- \\EXCEL.EXE
- \\POWERPNT.EXE
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\rundll32.exe
- \\mshta.exe
- \\control.exe
- \\InfDefaultInstall.exe
filter:
CommandLine|contains:
- AcroRd32
- /automation
condition: selection and not filter
falsepositives:
- Legitimate mail-merge, macro-driven automation, or add-in tooling that launches
helper processes from Office
- Enterprise document management add-ins invoking rundll32 for legitimate print/export
functions
level: high
tags:
- attack.t1203
- attack.execution
- cve.2021-40444
id: 9d47a318-d248-52f3-aa74-a7c6020f92dd
status: experimental
author: Vorant
InfDefaultInstall.exe Executing INF File (CVE-2021-40444 Payload Delivery)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of InfDefaultInstall.exe with a .inf file argument, the mechanism observed in CVE-2021-40444 exploitation to install malicious payloads downloaded via a crafted Office document. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: InfDefaultInstall Execution of INF File
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\InfDefaultInstall.exe
CommandLine|contains: '.inf'
condition: selection
falsepositives:
- Legitimate driver or device installation workflows that explicitly invoke InfDefaultInstall.exe
with vendor-signed INF packages
level: high
tags:
- attack.t1218
- attack.stealth
- cve.2021-40444
id: e18b5c9b-8c63-5b73-ad1a-e201258d745b
status: experimental
author: Vorant
MSHTML Component Loaded by Non-Browser Office Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects mshtml.dll or related ActiveX rendering components being loaded into Microsoft Office processes, a behavior associated with exploitation of the CVE-2021-40444 MSHTML remote code execution vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MSHTML DLL Loaded by Office Process
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith:
- \\WINWORD.EXE
- \\EXCEL.EXE
- \\POWERPNT.EXE
ImageLoaded|endswith: \\mshtml.dll
condition: selection
falsepositives:
- Legitimate documents embedding HTML-rendered content or ActiveX objects used by
internal business templates
level: medium
tags:
- attack.t1055
- attack.stealth
- cve.2021-40444
id: 6a9b2d83-8688-5059-9636-b359eeb77f76
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210915-ms.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs