Detect Microsoft Office Security Feature Bypass (CVE-2026-21509) in Splunk
Detects exploitation of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass security controls within Office applications, potentially enabling malicious document execution without expected security warnings or Protected View enforcement.
MITRE ATT&CK
- Tactic
- Initial Access Defense Evasion
SPL Detection Query
index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval parent_process=coalesce(ParentImage, parent_process_name)
| eval child_process=coalesce(Image, process_name)
| where match(parent_process, "(?i)(WINWORD|EXCEL|POWERPNT|OUTLOOK|MSPUB|VISIO|ONENOTE)\.EXE$")
| where (
match(child_process, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic)\.exe$")
OR (EventCode=11 AND match(TargetFilename, "(?i)(\\\\Temp\\\\|\\\\AppData\\\\)") AND match(TargetFilename, "(?i)\.(exe|dll|ps1|vbs|bat|js)$"))
OR (EventCode=13 AND match(TargetObject, "(?i)(DisableProtectedView|MarkOfTheWeb|TrustCenter|EnableUnsafeClientMailRules)"))
)
| eval technique="Security Feature Bypass", cve="CVE-2026-21509"
| eval risk_score=case(
match(child_process, "(?i)(powershell|mshta|wscript|cscript)\.exe$"), 85,
match(child_process, "(?i)(cmd|rundll32|regsvr32)\.exe$"), 75,
true(), 65
)
| table _time, host, user, parent_process, child_process, CommandLine, ParentCommandLine, TargetFilename, TargetObject, technique, cve, risk_score
| sort -risk_score, -_timeDetects Office processes spawning suspicious child processes, writing executables to temp paths, or modifying security-related registry keys — all indicators of CVE-2026-21509 security feature bypass exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate business macros launching approved helper scripts
- IT management software using Office automation with administrative PowerShell
- Office add-ins from trusted vendors that write DLLs to application data directories
- Software development and testing environments running Office automation tests
Other platforms for CVE-2026-21509
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Office Protected View Bypass via Registry Modification
Expected signal: Registry write events (Sysmon EventID 13) targeting HKCU\Software\Microsoft\Office\16.0\Word\Security with values DisableProtectedView and VBAWarnings modified
- Test 2Office Spawning PowerShell Child Process
Expected signal: Sysmon EventID 1 / Windows EventID 4688 showing WINWORD.EXE as ParentImage and powershell.exe as child Image with encoded or suspicious command-line arguments
- Test 3Office Dropping Executable to Temp Directory
Expected signal: Sysmon EventID 11 (FileCreate) showing an .exe file written to %TEMP% by an Office-related initiating process; DeviceFileEvents in MDE with InitiatingProcessFileName matching an Office executable
Unlock Pro Content
Get the full detection package for CVE-2026-21509 including response playbook, investigation guide, and atomic red team tests.