Microsoft Office Security Feature Bypass (CVE-2026-21509)

let timeWindow = 24h;
let suspiciousOfficeProcesses = dynamic(["WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "MSPUB.EXE", "VISIO.EXE", "ONENOTE.EXE"]);
let suspiciousChildProcesses = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe"]);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated >= ago(timeWindow)
| where (ActionType == "ProcessCreated" or EventID == 4688)
| extend ParentProcess = coalesce(InitiatingProcessFileName, ParentProcessName)
| extend ChildProcess = coalesce(FileName, NewProcessName)
| where ParentProcess in~ (suspiciousOfficeProcesses)
| where ChildProcess in~ (suspiciousChildProcesses)
| project TimeGenerated, DeviceName, AccountName, ParentProcess, ChildProcess, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath
| union (
    DeviceFileEvents
    | where TimeGenerated >= ago(timeWindow)
    | where InitiatingProcessFileName in~ (suspiciousOfficeProcesses)
    | where FolderPath has_any ("\\Temp\\", "\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\")
    | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".vbs"
    | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, ParentProcess = InitiatingProcessFileName, ChildProcess = FileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessCommandLine, FolderPath
)
| union (
    DeviceRegistryEvents
    | where TimeGenerated >= ago(timeWindow)
    | where InitiatingProcessFileName in~ (suspiciousOfficeProcesses)
    | where RegistryKey has_any ("DisableProtectedView", "MarkOfTheWeb", "TrustCenter", "Security")
    | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, ParentProcess = InitiatingProcessFileName, ChildProcess = RegistryKey, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessCommandLine, FolderPath = RegistryKey
)
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, AccountName, ParentProcess, ChildProcess
| where Count >= 1
| extend AlertSeverity = "High"
| extend CVE = "CVE-2026-21509"

index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval parent_process=coalesce(ParentImage, parent_process_name)
| eval child_process=coalesce(Image, process_name)
| where match(parent_process, "(?i)(WINWORD|EXCEL|POWERPNT|OUTLOOK|MSPUB|VISIO|ONENOTE)\.EXE$")
| where (
    match(child_process, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic)\.exe$")
    OR (EventCode=11 AND match(TargetFilename, "(?i)(\\\\Temp\\\\|\\\\AppData\\\\)") AND match(TargetFilename, "(?i)\.(exe|dll|ps1|vbs|bat|js)$"))
    OR (EventCode=13 AND match(TargetObject, "(?i)(DisableProtectedView|MarkOfTheWeb|TrustCenter|EnableUnsafeClientMailRules)"))
)
| eval technique="Security Feature Bypass", cve="CVE-2026-21509"
| eval risk_score=case(
    match(child_process, "(?i)(powershell|mshta|wscript|cscript)\.exe$"), 85,
    match(child_process, "(?i)(cmd|rundll32|regsvr32)\.exe$"), 75,
    true(), 65
  )
| table _time, host, user, parent_process, child_process, CommandLine, ParentCommandLine, TargetFilename, TargetObject, technique, cve, risk_score
| sort -risk_score, -_time

sequence by host.name with maxspan=5m
  [process where event.action == "start"
    and process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "MSPUB.EXE", "ONENOTE.EXE")
  ] by process.entity_id
  [process where event.action == "start"
    and process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "MSPUB.EXE", "ONENOTE.EXE")
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
  ] by process.parent.entity_id

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "ParentProcessName",
  "ProcessName",
  "CommandLine",
  sourceip,
  destinationip
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    ("ParentProcessName" ILIKE '%WINWORD.EXE%'
      OR "ParentProcessName" ILIKE '%EXCEL.EXE%'
      OR "ParentProcessName" ILIKE '%POWERPNT.EXE%'
      OR "ParentProcessName" ILIKE '%OUTLOOK.EXE%'
      OR "ParentProcessName" ILIKE '%ONENOTE.EXE%')
  )
  AND (
    "ProcessName" ILIKE '%cmd.exe%'
    OR "ProcessName" ILIKE '%powershell.exe%'
    OR "ProcessName" ILIKE '%wscript.exe%'
    OR "ProcessName" ILIKE '%cscript.exe%'
    OR "ProcessName" ILIKE '%mshta.exe%'
    OR "ProcessName" ILIKE '%rundll32.exe%'
    OR "ProcessName" ILIKE '%regsvr32.exe%'
    OR "ProcessName" ILIKE '%certutil.exe%'
  )
  AND LOGSOURCETIME(starttime) > NOW() - 24 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json field=_raw "EventID", "Image", "ParentImage", "CommandLine", "ParentCommandLine", "User", "Computer" nodrop
| where ParentImage matches /(?i)(WINWORD|EXCEL|POWERPNT|OUTLOOK|MSPUB|ONENOTE)\.EXE$/
| where Image matches /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/
| eval cve = "CVE-2026-21509"
| eval technique = "Office Security Feature Bypass"
| eval risk = if(Image matches /(?i)(powershell|mshta|wscript)\.exe$/, "HIGH", "MEDIUM")
| count by _time, Computer, User, ParentImage, Image, CommandLine, cve, technique, risk
| sort by _time desc

rule cve_2026_21509_office_security_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Microsoft Office spawning suspicious child processes - CVE-2026-21509 Security Feature Bypass"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509"
    cve = "CVE-2026-21509"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(WINWORD|EXCEL|POWERPNT|OUTLOOK|MSPUB|ONENOTE)\.EXE$/
    $proc.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/
    $proc.principal.hostname = $hostname

  condition:
    $proc
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "MSPUB.EXE", "ONENOTE.EXE")
| search FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| eval cve="CVE-2026-21509"
| eval technique="Office Security Feature Bypass"
| eval risk_score=case(
    FileName IN ("powershell.exe", "mshta.exe", "wscript.exe", "cscript.exe"), 85,
    FileName IN ("cmd.exe", "rundll32.exe", "regsvr32.exe"), 75,
    true(), 65
  )
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ParentCommandLine, cve, technique, risk_score
| sort -timestamp