CVE-2026-21509 Sumo Logic CSE · Sumo

Detect Microsoft Office Security Feature Bypass (CVE-2026-21509) in Sumo Logic CSE

Detects exploitation of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass security controls within Office applications, potentially enabling malicious document execution without expected security warnings or Protected View enforcement.

MITRE ATT&CK

Tactic
Initial Access Defense Evasion

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json field=_raw "EventID", "Image", "ParentImage", "CommandLine", "ParentCommandLine", "User", "Computer" nodrop
| where ParentImage matches /(?i)(WINWORD|EXCEL|POWERPNT|OUTLOOK|MSPUB|ONENOTE)\.EXE$/
| where Image matches /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/
| eval cve = "CVE-2026-21509"
| eval technique = "Office Security Feature Bypass"
| eval risk = if(Image matches /(?i)(powershell|mshta|wscript)\.exe$/, "HIGH", "MEDIUM")
| count by _time, Computer, User, ParentImage, Image, CommandLine, cve, technique, risk
| sort by _time desc
high severity medium confidence

Sumo Logic query detecting Microsoft Office parent processes spawning suspicious child processes indicative of CVE-2026-21509 security feature bypass exploitation.

Data Sources

Windows SysmonWindows Security Events

Required Tables

windows/sysmonwindows/security

False Positives & Tuning

  • Approved Office macros triggering PowerShell for business report generation
  • IT operations using Office COM automation with cmd.exe for deployment tasks
  • Document scanning workflows that invoke certutil for certificate validation
  • Software build pipelines that test Office document generation

Other platforms for CVE-2026-21509

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Office Protected View Bypass via Registry Modification

    Expected signal: Registry write events (Sysmon EventID 13) targeting HKCU\Software\Microsoft\Office\16.0\Word\Security with values DisableProtectedView and VBAWarnings modified

  2. Test 2Office Spawning PowerShell Child Process

    Expected signal: Sysmon EventID 1 / Windows EventID 4688 showing WINWORD.EXE as ParentImage and powershell.exe as child Image with encoded or suspicious command-line arguments

  3. Test 3Office Dropping Executable to Temp Directory

    Expected signal: Sysmon EventID 11 (FileCreate) showing an .exe file written to %TEMP% by an Office-related initiating process; DeviceFileEvents in MDE with InitiatingProcessFileName matching an Office executable

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected host and user account; correlate the Office parent process PID with the suspicious child process to confirm the process tree relationship and rule out coincidental timing.
  2. Examine the command-line arguments of both the Office parent and child process for encoded payloads, unusual file paths (Temp, AppData), or network-referencing arguments (URLs, UNC paths) that indicate active exploitation.
  3. Check if the Office document involved was received via email, downloaded from the internet, or opened from a network share — retrieve the file path from process telemetry and verify the Mark of the Web (MOTW) status to assess whether the bypass suppressed expected security prompts.
  4. Review Office Trust Center registry settings (HKCU\Software\Microsoft\Office\<version>\<app>\Security) for unexpected modifications such as DisableProtectedView=1 or VBAWarnings changes that may have been made by the exploit.

Containment

  1. Isolate the affected endpoint from the network immediately if active exploitation is confirmed or if the child process made outbound network connections — use EDR isolation capability to prevent lateral movement or C2 communications.
  2. Terminate the suspicious child process and any processes it spawned; revoke active user sessions on the host and reset credentials for the affected account, particularly if the process tree shows credential-access tooling (mimikatz patterns, LSASS access).

Evidence Collection

  1. Collect a memory image of the affected endpoint (prioritizing the Office process and child process memory regions) and export the full process tree with command-line arguments, parent-child relationships, and network connections from EDR telemetry before remediation.
  2. Preserve the original Office document that triggered the process launch — hash it (SHA256), quarantine a copy for malware analysis, and document the full file path, download source, and email headers if applicable.

Escalation Criteria

  • !Escalate to IR if the child process made outbound connections, if LSASS was accessed, if lateral movement artifacts are found (PsExec, WMI remote execution, SMB to other hosts), or if the attack pattern appears on multiple endpoints simultaneously.
  • !Escalate if the malicious document was distributed via internal email or shared drive, indicating potential compromise of an internal sender account or a supply-chain document delivery attack.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Prefetch files for Office executables (WINWORD.EXE, EXCEL.EXE) and child processes (powershell.exe, cmd.exe) at C:\Windows\Prefetch\ — timestamps indicate execution time
  • >Windows Registry keys: HKCU\Software\Microsoft\Office\<version>\<app>\Security — check VBAWarnings, DisableProtectedView, and EnableUnsafeClientMailRules values and their last-write timestamps
  • >LNK/recent files: %APPDATA%\Microsoft\Office\Recent — identify the document that triggered the process chain
  • >Event log 4688 (process creation with command line) in the Security event log or Sysmon Event ID 1 for full process ancestry
  • >Zone.Identifier alternate data stream on the original document file — absence or tampering with MOTW indicates the bypass was applied

Tuning Guidance

Start by scoping to high-risk user populations (executives, finance, HR) who are most likely spearphishing targets, and apply an allowlist of known-good Office macro scripts approved through change management. Reduce false positives by excluding Office processes that spawn children from approved software installer paths (e.g., C:\Program Files\) and by correlating with email delivery data — only alert when the Office document was received externally within the prior 48 hours. Tune severity upward if the child process attempts network connections or accesses credential stores.

Hunting Queries

Hunt for Office processes directly modifying security-related registry keys in Trust Center and macro security settings — a strong indicator of CVE-2026-21509 exploitation attempting to persist the bypass condition across sessions.

Hunting — KQL
kql 
DeviceRegistryEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE")
| where RegistryKey has_any ("DisableProtectedView", "VBAWarnings", "EnableUnsafeClientMailRules", "TrustCenter")
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| where match(Image, "(?i)(WINWORD|EXCEL|POWERPNT|OUTLOOK)\.EXE$")
| where match(TargetObject, "(?i)(DisableProtectedView|VBAWarnings|EnableUnsafeClientMailRules|TrustCenter)")
| table _time, host, user, Image, TargetObject, Details

Atomic Red Team Tests

Test 1 Office Protected View Bypass via Registry Modification
windows

Simulates CVE-2026-21509 by disabling Office Protected View through registry modification, then opening a document that would normally trigger Protected View. Tests detection of security feature tampering initiated by or for Office applications.

Command

powershell 
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v DisableProtectedView /t REG_DWORD /d 1 /f && reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v VBAWarnings /t REG_DWORD /d 1 /f && echo [TEST] Protected View disabled for Word

Cleanup

powershell 
reg delete "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v DisableProtectedView /f && reg delete "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v VBAWarnings /f

Expected Telemetry

Registry write events (Sysmon EventID 13) targeting HKCU\Software\Microsoft\Office\16.0\Word\Security with values DisableProtectedView and VBAWarnings modified

Expected Detection

Alert on registry modification of Office security keys; triggered by the KQL DeviceRegistryEvents hunt query and SPL Sysmon EventCode=13 query

Test 2 Office Spawning PowerShell Child Process
windows

Simulates the post-bypass execution stage of CVE-2026-21509 by directly launching PowerShell as a child of a Word process using Windows Script Host to emulate macro execution behavior. Tests process lineage detection rules.

Command

powershell 
powershell -Command "Start-Process 'WINWORD.EXE' -ArgumentList '/q'; Start-Sleep 3; $word = Get-Process WINWORD -ErrorAction SilentlyContinue; if ($word) { Start-Process 'powershell.exe' -ArgumentList '-NoP -W Hidden -C whoami' }"

Cleanup

powershell 
Stop-Process -Name WINWORD -Force -ErrorAction SilentlyContinue; Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon EventID 1 / Windows EventID 4688 showing WINWORD.EXE as ParentImage and powershell.exe as child Image with encoded or suspicious command-line arguments

Expected Detection

Triggers all seven SIEM queries detecting Office-to-PowerShell process lineage; CrowdStrike ProcessRollup2 event with ParentBaseFileName=WINWORD.EXE and FileName=powershell.exe

Test 3 Office Dropping Executable to Temp Directory
windows

Simulates the file-drop stage of CVE-2026-21509 exploitation where a bypassed Office document writes a payload to a temporary directory. Tests file creation detection from Office parent processes.

Command

powershell 
powershell -Command "$tempPath = [System.IO.Path]::GetTempPath() + 'test_payload.exe'; [System.IO.File]::WriteAllBytes($tempPath, [byte[]](77,90,0,0)); Write-Host 'Dropped simulated payload to: ' $tempPath"

Cleanup

powershell 
Remove-Item "$env:TEMP\test_payload.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon EventID 11 (FileCreate) showing an .exe file written to %TEMP% by an Office-related initiating process; DeviceFileEvents in MDE with InitiatingProcessFileName matching an Office executable

Expected Detection

Triggers the KQL DeviceFileEvents union branch detecting Office processes writing executables to Temp/AppData paths; Sysmon EventCode=11 branch in the SPL query

Related Detections

Tactic Hubs

TA0001Initial AccessTA0005Defense Evasion

Related Techniques

T1566.001Spearphishing AttachmentT1203Exploitation for Client ExecutionT1562.001Disable or Modify Tools

Same Tactic: Initial Access

Popular Detections