CVE-2021-40444 MSHTML Flaw Exploited

14 September 2021 high vulnerability

A Microsoft MSHTML remote code execution vulnerability (CVE-2021-40444) is being actively exploited; Microsoft has released a patch and urges immediate application.

IPA (Information-technology Promotion Agency, Japan) issued an alert regarding CVE-2021-40444, a vulnerability in Microsoft MSHTML affecting multiple Windows products. Microsoft confirmed that exploitation of this vulnerability has been observed in the wild, allowing attackers to execute arbitrary code on affected systems, potentially leading to a range of damages.

Microsoft initially provided workarounds and mitigation measures while a fix was pending, and subsequently released a security update in the September 2021 Patch Tuesday cycle addressing the flaw. IPA urges organizations to apply the official patch immediately and, in the interim, to consider Microsoft's recommended workarounds and mitigations to reduce exposure to ongoing exploitation.

Mentioned in this report

Vulnerabilities CVE-2021-40444KEV

Detection guidance

Microsoft Office Spawning Suspicious Child Process (Possible CVE-2021-40444 MSHTML Exploitation)

ATT&CK T1203

Detects Office applications (Word/Excel/PowerPoint) spawning script interpreters or LOLBins shortly after opening a document, consistent with MSHTML exploitation via CVE-2021-40444. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Spawning Suspicious Child Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \WORDPAD.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \control.exe
    - \wscript.exe
    - \cscript.exe
  filter:
    CommandLine|contains:
    - /n
    - /dde
  condition: selection and not filter
falsepositives:
- Legitimate macro-enabled workflows or add-ins that spawn scripting hosts
- Document automation tools invoking helper processes from Office
level: high
tags:
- attack.t1203
id: ba81ad84-5c98-590d-a903-edeec51b30cc
status: experimental
author: Vorant

Rundll32 Execution of mshtml RunHTMLApplication (CVE-2021-40444 Exploit Chain)

ATT&CK T1203

Detects rundll32.exe invoking mshtml.dll's RunHTMLApplication export, a hallmark of the CVE-2021-40444 MSHTML exploitation chain used to execute embedded malicious HTML/ActiveX content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Rundll32 mshtml RunHTMLApplication Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    CommandLine|contains|all:
    - mshtml
    - RunHTMLApplication
  condition: selection
falsepositives:
- Extremely rare in legitimate administration; verify against known false positive
  baselines before excluding
level: high
tags:
- attack.t1203
id: 19949c96-7699-5382-9ac8-aea598e86bf4
status: experimental
author: Vorant

Control.exe Invoked with INF/CPL Argument Leading to Rundll32 (CVE-2021-40444 Pattern)

ATT&CK T1203

Detects control.exe being executed with an INF or CPL-style argument, part of the CVE-2021-40444 exploitation chain that abuses the Control Panel process to stage further code execution after MSHTML rendering. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Control.exe Suspicious INF or CPL Argument Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \control.exe
    CommandLine|contains:
    - '.inf'
    - .cpl
  filter:
    CommandLine|contains:
    - \System32\
    - Microsoft\Windows\INF
  condition: selection and not filter
falsepositives:
- Legitimate control panel applet launches referencing system INF/CPL files
- Software installers registering control panel extensions
level: medium
tags:
- attack.t1203
id: fa56f6cb-46a0-583d-97c5-f3c4b2045cb9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210908-ms.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free