SecBoard
Zurück zur CVE-Übersicht

CVE-2021-34478

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score35/100 — MITTEL
  • CVSS 7.8 — Hoch
  • EPSS 51%

EPSS-Score

51.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

SecBoard-Einordnung

CVE-2021-34478 ist eine () Schwachstelle in Microsoft Office und Microsoft 365 Apps. Ein erfolgreicher könnte einem Angreifer ermöglichen, beliebigen Code auf dem betroffenen System auszuführen. Dies kann zu einer vollständigen Kompromittierung der Integrität, Vertraulichkeit und Verfügbarkeit führen.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

Microsoft Office Remote Code Execution Vulnerability

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects suspicious process creation by Microsoft Word, indicative of a successful out-of-bounds write leading to arbitrary code execution.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe")
| where ProcessCommandLine contains "http" or ProcessCommandLine contains "ftp" or ProcessCommandLine contains "smb"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=your_windows_index sourcetype=your_process_creation_sourcetype
| where ParentProcessName="WINWORD.EXE"
| where ProcessName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe")
| where CommandLine LIKE "%http%" OR CommandLine LIKE "%ftp%" OR CommandLine LIKE "%smb%"
| table _time, host, ParentProcessName, ProcessName, CommandLine, ProcessPath

Sigma

title: Word Spawns Suspicious Process
status: experimental
description: Detects Microsoft Word spawning suspicious child processes, potentially indicating exploitation of CVE-2021-34478.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\WINWORD.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
tags:
  - attack.execution
  - cve.2021.34478

Elastic ES|QL

from process where event.action == "process_started"
| where process.parent.executable == "WINWORD.EXE"
| where process.executable in ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe")
| where process.args contains "http" or process.args contains "ftp" or process.args contains "smb"
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, process.working_directory

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*

Referenzen