CVE-2026-21513 Google Chronicle · YARA-L

Detect CVE-2026-21513 — Microsoft MSHTML Framework Protection Mechanism Failure in Google Chronicle

Detects exploitation of CVE-2026-21513, a protection mechanism failure (CWE-693) in the Microsoft MSHTML framework on Windows. This KEV-listed vulnerability allows attackers to bypass security controls implemented in MSHTML, potentially enabling code execution via crafted web content processed by Internet Explorer compatibility components, Microsoft Office documents embedding web content, or applications using the WebBrowser control. Active exploitation has been confirmed by CISA.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_21513_mshtml_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-21513 MSHTML protection mechanism bypass exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(winword|excel|powerpnt|outlook|mspub|msaccess|onenote)\.exe$/
    $proc.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$/
    $proc.principal.hostname = $host
    $proc.principal.user.userid = $user

    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.principal.process.file.full_path = /(?i)(mshta|dllhost)\.exe$/
    not $net.target.ip = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
    $net.principal.hostname = $host

  match:
    $host, $user over 10m

  condition:
    $proc and $net
}
high severity high confidence

Chronicle YARA-L rule correlating Office application child process spawning with external network connections from MSHTML-related processes within a 10-minute window on the same host, detecting CVE-2026-21513 exploitation chains.

Data Sources

Chronicle UDMGoogle Workspace Audit LogsWindows Event Logs via Chronicle Forwarder

Required Tables

UDM Events

False Positives & Tuning

  • Legitimate business workflows using Office macros that make authorized external API calls
  • IT monitoring agents running within Office process context for compliance purposes
  • Vendor-provided Office integrations that use MSHTML for rendering vendor portals
  • Automated report generation systems that fetch data from external services via Office

Other platforms for CVE-2026-21513

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1MSHTML MkNode Method Invocation via mshta.exe

    Expected signal: Sysmon Event ID 1 showing mshta.exe spawning cmd.exe; Sysmon Event ID 7 showing mshtml.dll and vbscript.dll loaded by mshta.exe; Process creation events in Windows Security Log (Event ID 4688)

  2. Test 2Office Document Spawning Scripting Engine via MSHTML

    Expected signal: Process creation events showing WINWORD.EXE as parent of cmd.exe or powershell.exe; MSHTML DLL load events in Sysmon EventID 7 for the Office process; Network events if payload attempts callback

  3. Test 3rundll32.exe MSHTML Script Execution via ieframe.dll

    Expected signal: Sysmon Event ID 1 for rundll32.exe execution; Event ID 7 showing ieframe.dll and mshtml.dll loaded by rundll32.exe; Any network connections initiated by the rundll32.exe process to external hosts

  4. Test 4PowerShell WebBrowser COM Object MSHTML Load

    Expected signal: PowerShell process creation event; mshtml.dll loaded into powershell.exe process space (Sysmon Event ID 7); Potential network connection if URL is replaced with live payload URL

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected host and user account involved in the alert. Determine whether the process tree originates from an Office application, browser, or other application loading MSHTML. Correlate against asset inventory to assess host criticality.
  2. Review the full command line of any child processes spawned by Office applications. Identify encoded PowerShell commands, unusual flags (e.g., -ExecutionPolicy Bypass, -WindowStyle Hidden), or invocations of LOLBins (mshta, rundll32, regsvr32) that may indicate payload delivery.
  3. Check network telemetry for external connections made by MSHTML-associated processes. Identify destination IPs and domains, and cross-reference with threat intelligence feeds for known C2 infrastructure. Capture any URLs accessed during the suspicious session.
  4. Determine the source document or URL that triggered MSHTML processing. Inspect email headers if the vector was Outlook, or review browser history and download logs if the vector was a web-based attack. Identify whether the document arrived via email attachment, web download, or network share.

Containment

  1. Isolate the affected host from the network immediately using EDR quarantine capabilities to prevent lateral movement or C2 beacon establishment. Preserve volatile memory before isolation where possible.
  2. Disable or revoke the compromised user account credentials and force password reset for any accounts that authenticated from the affected host within the exploitation window. Invalidate active sessions and OAuth tokens associated with the account.

Evidence Collection

  1. Collect a full memory dump of the affected host and preserve it for offline analysis. Capture process memory for the Office application instance and any spawned child processes before they terminate. Use tools such as WinPmem or ProcDump targeting the suspicious PIDs.
  2. Extract and preserve the source document (Office file, HTML file, or URL) that triggered the MSHTML vulnerability. Hash the document and submit to sandboxing infrastructure. Preserve email headers, browser cache, and download history from the affected user profile.

Escalation Criteria

  • !Escalate immediately if C2 communication is confirmed or if the spawned process performed credential dumping (e.g., LSASS access, SAM database reads, or invocation of Mimikatz-like tooling). This indicates active post-exploitation and requires IR team engagement.
  • !Escalate if the same exploitation pattern is detected across multiple hosts within a short timeframe, indicating a campaign or worm-like lateral propagation using CVE-2026-21513 as the initial access vector.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Windows Event Log entries (Event ID 4688 process creation, Event ID 4663 object access) showing Office application spawning scripting engines
  • >Sysmon Event ID 1 logs capturing full command lines of child processes with ParentImage pointing to Office executables
  • >Prefetch files (.pf) in C:\Windows\Prefetch for mshta.exe, wscript.exe, cscript.exe showing recent execution timestamps
  • >Registry Run keys or scheduled tasks created post-exploitation for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • >Network connection artifacts in Windows Filtering Platform logs and Sysmon Event ID 3 showing outbound connections from MSHTML host processes
  • >Temporary files in %TEMP%, %APPDATA%, and %LOCALAPPDATA% created during exploitation, including downloaded payloads and dropped scripts

Tuning Guidance

Start by baselining which Office applications in your environment legitimately spawn scripting engines — some environments with heavy macro usage may require per-process or per-user exclusions. The DLL load detection (EventCode 7) is high-fidelity when filtered to Office parent processes but may generate volume in environments with many Office add-ins. Tune the network detection by building an allowlist of known-good external domains accessed by Office automation in your organization. In environments where Internet Explorer mode is actively used in Edge, adjust parent process filters accordingly. Consider enriching alerts with user risk scores and asset criticality ratings from your CMDB to auto-triage low-risk alerts. For VIP or privileged user accounts, lower the detection threshold and alert immediately without aggregation.

Hunting Queries

30-day retrospective hunt for Office application spawning scripting engines, identifying historical exploitation attempts or missed detections of CVE-2026-21513 activity in the environment

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("mshta.exe", "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe")
| summarize count(), make_set(ProcessCommandLine), make_set(DeviceName) by InitiatingProcessFileName, FileName, bin(Timestamp, 1d)
| order by count_ desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where match(lower(ParentImage), "(winword|excel|powerpnt|outlook)\.exe")
| where match(lower(Image), "(mshta|wscript|cscript|powershell|cmd)\.exe")
| stats count BY host, user, ParentImage, Image, CommandLine
| sort -count

Hunt for MSHTML-family DLL loads from unexpected processes that should not normally load these libraries, identifying potential exploitation attempts or living-off-the-land abuse of MSHTML outside normal browser contexts

Hunting — KQL
kql 
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName in~ ("mshtml.dll", "jscript9.dll", "vbscript.dll")
| where InitiatingProcessFileName !in~ ("iexplore.exe", "microsoftedge.exe", "edgehtml.dll", "svchost.exe")
| summarize count(), make_set(InitiatingProcessFileName), make_set(DeviceName) by FileName, bin(Timestamp, 1d)
| order by count_ desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=7
| where match(lower(ImageLoaded), "(mshtml|jscript9|vbscript)\.dll")
| where NOT match(lower(Image), "(iexplore|microsoftedge|edgehtml|svchost)\.exe")
| stats count values(Image) AS loading_processes BY host, ImageLoaded
| sort -count

Atomic Red Team Tests

Test 1 MSHTML MkNode Method Invocation via mshta.exe
windows

Simulates CVE-2026-21513 exploitation by using mshta.exe to process a crafted HTML Application (HTA) file that invokes MSHTML internals and spawns a child process, mimicking the protection bypass mechanism.

Command

powershell 
echo '<html><head><script language="VBScript">Set oShell = CreateObject("WScript.Shell") : oShell.Run "cmd.exe /c whoami > %TEMP%\mshtml_test.txt", 0, True</script></head><body onload="window.close()"></body></html>' > %TEMP%\test_cve_2026_21513.hta && mshta.exe %TEMP%\test_cve_2026_21513.hta

Cleanup

powershell 
del %TEMP%\test_cve_2026_21513.hta & del %TEMP%\mshtml_test.txt

Expected Telemetry

Sysmon Event ID 1 showing mshta.exe spawning cmd.exe; Sysmon Event ID 7 showing mshtml.dll and vbscript.dll loaded by mshta.exe; Process creation events in Windows Security Log (Event ID 4688)

Expected Detection

Alert fires on MSHTML_ChildProcess or MSHTML_DLLLoad alert types; CrowdStrike alert on ClassifiedModuleLoad of vbscript.dll by mshta.exe with subsequent ProcessRollup2 of cmd.exe

Test 2 Office Document Spawning Scripting Engine via MSHTML
windows

Simulates the delivery vector for CVE-2026-21513 by creating a Word document with an embedded macro that uses the WebBrowser control (backed by MSHTML) to load content and spawn a child scripting process.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "$word = New-Object -ComObject Word.Application; $word.Visible = $false; $doc = $word.Documents.Add(); $macro = 'Sub AutoOpen() : Dim sh As Object : Set sh = CreateObject(chr(87)&chr(83)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(46)&chr(83)&chr(104)&chr(101)&chr(108)&chr(108)) : sh.Run chr(99)&chr(109)&chr(100)&chr(32)&chr(47)&chr(99)&chr(32)&chr(119)&chr(104)&chr(111)&chr(97)&chr(109)&chr(105) : End Sub'; $word.Quit(); Write-Host 'Simulation complete - check EDR for winword.exe spawning child processes'"

Cleanup

powershell 
Stop-Process -Name winword -Force -ErrorAction SilentlyContinue

Expected Telemetry

Process creation events showing WINWORD.EXE as parent of cmd.exe or powershell.exe; MSHTML DLL load events in Sysmon EventID 7 for the Office process; Network events if payload attempts callback

Expected Detection

Detection fires on Office application spawning scripting engine (MSHTML_ChildProcess); EDR behavioral alert on macro-enabled document executing shell commands

Test 3 rundll32.exe MSHTML Script Execution via ieframe.dll
windows

Tests detection coverage for the rundll32-based MSHTML abuse technique where ieframe.dll entry points are invoked to load and execute script content, bypassing application-layer protections.

Command

powershell 
rundll32.exe ieframe.dll,OpenURL %CD%\test.url

Cleanup

powershell 
del test.url 2>nul

Expected Telemetry

Sysmon Event ID 1 for rundll32.exe execution; Event ID 7 showing ieframe.dll and mshtml.dll loaded by rundll32.exe; Any network connections initiated by the rundll32.exe process to external hosts

Expected Detection

Detection fires on MSHTML_DLLLoad for ieframe.dll loaded by rundll32.exe; Network detection alert if rundll32 initiates outbound connection; CrowdStrike alert on suspicious ClassifiedModuleLoad pattern

Test 4 PowerShell WebBrowser COM Object MSHTML Load
windows

Simulates an attacker using PowerShell to instantiate the WebBrowser COM object (which loads MSHTML) and navigate to a URL that would trigger the CVE-2026-21513 protection bypass, representing a script-based exploitation path.

Command

powershell 
powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $wb = New-Object System.Windows.Forms.WebBrowser; $wb.Navigate('about:blank'); Start-Sleep 2; Write-Host 'MSHTML loaded via WebBrowser control'"

Cleanup

powershell 
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

Expected Telemetry

PowerShell process creation event; mshtml.dll loaded into powershell.exe process space (Sysmon Event ID 7); Potential network connection if URL is replaced with live payload URL

Expected Detection

Alert on MSHTML DLL load by PowerShell (unexpected parent for mshtml.dll); Behavioral detection on PowerShell loading browser engine components

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1203Exploitation for Client ExecutionT1059.005Visual BasicT1218.011Rundll32T1566.001Spearphishing Attachment

Same Tactic: Initial Access

Popular Detections