CVE-2016-3313

Sentinel/Defender KQL

DeviceFileEvents
| where FileName endswith ".doc"
| where InitiatingProcessCommandLine contains "WordDocumentStream" and InitiatingProcessCommandLine contains "invalid" // Placeholder for detecting invalid WordDocumentStream access
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=* sourcetype=ms_office_logs (file_name="*.doc" AND (command_line="*WordDocumentStream*" AND command_line="*invalid*")) | table _time, host, command_line, file_name, file_path, sha256

Sigma

title: Microsoft Office Word Out-of-Bounds Read Code Execution
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2016-3313 in Microsoft Office Word via crafted .doc files.
author: SecBoard
date: 2023/10/27
references:
  - https://www.exploit-db.com/exploits/40224/
tags:
  - attack.execution
  - cve.2016.3313
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: 
      - '\WINWORD.EXE'
    CommandLine|contains:
      - '.doc'
      - 'WordDocumentStream'
      - 'invalid' # Placeholder for detecting invalid WordDocumentStream access
  condition: selection
level: high

Elastic ES|QL

FROM process
WHERE process.executable.endswith('WINWORD.EXE')
  AND process.args LIKE '%.doc%'
  AND process.command_line LIKE '%WordDocumentStream%'
  AND process.command_line LIKE '%invalid%' // Placeholder for detecting invalid WordDocumentStream access
SELECT @timestamp, host.name, process.command_line, file.name, file.path, hash.sha256