Adobe Acrobat/Reader zero-day exploited in wild

11 May 2021 high vulnerability

Adobe patched an actively exploited use-after-free flaw (CVE-2021-28550) in Acrobat and Reader; IPA urges immediate updates.

Japan's IPA issued an alert regarding a vulnerability in Adobe Acrobat and Reader disclosed by Adobe under advisory APSB21-29. Adobe confirmed that CVE-2021-28550 has been exploited in the wild, prompting IPA to urge users to apply the patch immediately.

Mentioned in this report

Vulnerabilities CVE-2021-28550KEV

Detection guidance

Adobe Acrobat/Reader Spawning Suspicious Child Process

ATT&CK T1203

Detects Acrobat/Reader (Acrobat.exe, AcroRd32.exe) launching command interpreters or scripting engines, consistent with exploitation of a PDF-parsing vulnerability such as CVE-2021-28550. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Adobe Acrobat or Reader Spawning Command Interpreter
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\Acrobat.exe
    - \\AcroRd32.exe
    - \\RdrCEF.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\regsvr32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms invoking helper scripts
- Enterprise deployment tools that automate Acrobat via scripting
level: high
tags:
- attack.t1203
- attack.execution
id: 6aa03f3e-ec04-5c2a-9a28-b79a88a105b2
status: experimental
author: Vorant

Adobe Acrobat/Reader Writing Executable or Script to Disk

ATT&CK T1203

Detects Acrobat/Reader processes creating executable, DLL, or script files outside normal cache/temp update paths, which may indicate a dropped payload following exploitation of a PDF parsing vulnerability like CVE-2021-28550. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Adobe Acrobat or Reader Dropping Executable or Script File
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \\Acrobat.exe
    - \\AcroRd32.exe
    - \\RdrCEF.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .js
    - .hta
  filter_update:
    TargetFilename|contains:
    - \\Adobe\\ARM\\
    - \\Adobe\\Acrobat\\
  condition: selection_image and selection_target and not filter_update
falsepositives:
- Adobe auto-update process legitimately writing new binaries during patching
- Third-party Acrobat plugins installing helper DLLs
level: medium
tags:
- attack.t1203
- attack.persistence
id: 79593330-3977-54ac-832b-699f693f7a34
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210512-adobereader.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free