# Microsoft Patches Actively Exploited CVE-2021-40444

Published: 2021-09-14 · Severity: high
Canonical: https://vorant.io/reports/76b568db-a24b-5a68-bcac-90c4d0e3f692/microsoft-patches-actively-exploited-cve-2021-40444

> Microsoft released fixes for multiple vulnerabilities including CVE-2021-40444, an MSHTML flaw already exploited in the wild, and IPA urges urgent patching.

Japan's IPA issued an alert on September 15, 2021, following Microsoft's monthly security update, which addresses multiple vulnerabilities in Microsoft products. Exploitation of these flaws could cause application crashes or allow attackers to gain control of affected systems.

Of particular concern is CVE-2021-40444, a vulnerability in the MSHTML component that Microsoft confirmed had already been exploited in the wild. IPA had previously issued an emergency advisory on September 8, 2021 regarding this specific flaw prior to the patch's availability. Given the confirmed active exploitation and potential for expanded attacks, IPA is urging all users and organizations to apply the Microsoft patches immediately via Windows Update.

## Mentioned in this report

- Vulnerabilities: CVE-2021-40444 (KEV)

## Detection guidance (public sample)

### Office Application Spawning Suspicious Child Process (Possible CVE-2021-40444 Exploitation)

ATT&CK: T1203

Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command interpreters or system utilities, consistent with exploitation of the MSHTML CVE-2021-40444 vulnerability via malicious document. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Suspicious Child Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\WINWORD.EXE
    - \\EXCEL.EXE
    - \\POWERPNT.EXE
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\rundll32.exe
    - \\mshta.exe
    - \\control.exe
    - \\InfDefaultInstall.exe
  filter:
    CommandLine|contains:
    - AcroRd32
    - /automation
  condition: selection and not filter
falsepositives:
- Legitimate mail-merge, macro-driven automation, or add-in tooling that launches
  helper processes from Office
- Enterprise document management add-ins invoking rundll32 for legitimate print/export
  functions
level: high
tags:
- attack.t1203
- attack.execution
- cve.2021-40444
id: 9d47a318-d248-52f3-aa74-a7c6020f92dd
status: experimental
author: Vorant
```

### InfDefaultInstall.exe Executing INF File (CVE-2021-40444 Payload Delivery)

ATT&CK: T1218

Detects execution of InfDefaultInstall.exe with a .inf file argument, the mechanism observed in CVE-2021-40444 exploitation to install malicious payloads downloaded via a crafted Office document. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: InfDefaultInstall Execution of INF File
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\InfDefaultInstall.exe
    CommandLine|contains: '.inf'
  condition: selection
falsepositives:
- Legitimate driver or device installation workflows that explicitly invoke InfDefaultInstall.exe
  with vendor-signed INF packages
level: high
tags:
- attack.t1218
- attack.defense_evasion
- cve.2021-40444
id: e18b5c9b-8c63-5b73-ad1a-e201258d745b
status: experimental
author: Vorant
```

### MSHTML Component Loaded by Non-Browser Office Process

ATT&CK: T1055

Detects mshtml.dll or related ActiveX rendering components being loaded into Microsoft Office processes, a behavior associated with exploitation of the CVE-2021-40444 MSHTML remote code execution vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MSHTML DLL Loaded by Office Process
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
    - \\WINWORD.EXE
    - \\EXCEL.EXE
    - \\POWERPNT.EXE
    ImageLoaded|endswith: \\mshtml.dll
  condition: selection
falsepositives:
- Legitimate documents embedding HTML-rendered content or ActiveX objects used by
  internal business templates
level: medium
tags:
- attack.t1055
- attack.defense_evasion
- cve.2021-40444
id: 6a9b2d83-8688-5059-9636-b359eeb77f76
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210915-ms.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/76b568db-a24b-5a68-bcac-90c4d0e3f692/microsoft-patches-actively-exploited-cve-2021-40444.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup