CVE-2021-38646

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("MSACCESS.EXE", "EXCEL.EXE", "WINWORD.EXE", "OUTLOOK.EXE")
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any ("http", "https", "ftp", "smb") or ProcessCommandLine has_any (".exe", ".dll")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessCommandLine

Splunk SPL

index=your_windows_logs (ParentProcessName="msaccess.exe" OR ParentProcessName="excel.exe" OR ParentProcessName="winword.exe" OR ParentProcessName="outlook.exe") (ProcessName="powershell.exe" OR ProcessName="cmd.exe" OR ProcessName="wscript.exe" OR ProcessName="cscript.exe" OR ProcessName="mshta.exe") (CommandLine=*http* OR CommandLine=*https* OR CommandLine=*ftp* OR CommandLine=*smb* OR CommandLine=*.exe* OR CommandLine=*.dll*)
| table _time, host, ParentProcessName, ProcessName, CommandLine, ProcessPath

Sigma

title: Microsoft Office ACE RCE Behavioral Detection
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious process creation by Microsoft Office applications, potentially indicating exploitation of CVE-2021-38646.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\MSACCESS.EXE'
      - '\EXCEL.EXE'
      - '\WINWORD.EXE'
      - '\OUTLOOK.EXE'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - cve.2021.38646

Elastic ES|QL

from process where
  (process.parent.executable.full_path : "*\\MSACCESS.EXE" or
   process.parent.executable.full_path : "*\\EXCEL.EXE" or
   process.parent.executable.full_path : "*\\WINWORD.EXE" or
   process.parent.executable.full_path : "*\\OUTLOOK.EXE") and
  (process.executable.full_path : "*\\powershell.exe" or
   process.executable.full_path : "*\\cmd.exe" or
   process.executable.full_path : "*\\wscript.exe" or
   process.executable.full_path : "*\\cscript.exe" or
   process.executable.full_path : "*\\mshta.exe") and
  (process.args : "*http*" or process.args : "*https*" or process.args : "*ftp*" or process.args : "*smb*" or process.args : "*.exe*" or process.args : "*.dll*")
| project @timestamp, host.name, process.parent.executable.full_path, process.executable.full_path, process.command_line