Microsoft Office Word Reliance on Untrusted Inputs in Security Decision (CVE-2026-21514)

let suspiciousWordChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ (suspiciousWordChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| union (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "WINWORD.EXE"
    | where FolderPath has_any ("\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\", "C:\\Windows\\Temp\\")
    | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".vbs" or FileName endswith ".ps1" or FileName endswith ".hta"
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
)
| union (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "WINWORD.EXE"
    | where RemoteIPType !in ("Private", "Loopback")
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
)
| sort by TimeGenerated desc

index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where ParentImage LIKE "%WINWORD.EXE"
| where Image LIKE "%cmd.exe" OR Image LIKE "%powershell.exe" OR Image LIKE "%wscript.exe" OR Image LIKE "%cscript.exe" OR Image LIKE "%mshta.exe" OR Image LIKE "%rundll32.exe" OR Image LIKE "%regsvr32.exe" OR Image LIKE "%certutil.exe" OR Image LIKE "%bitsadmin.exe" OR Image LIKE "%msiexec.exe"
| eval risk_score=case(
    Image LIKE "%mshta.exe", 90,
    Image LIKE "%powershell.exe" AND (CommandLine LIKE "%-enc%" OR CommandLine LIKE "%-EncodedCommand%"), 95,
    Image LIKE "%regsvr32.exe", 85,
    Image LIKE "%certutil.exe", 80,
    true(), 70
  )
| table _time, host, user, ParentImage, ParentCommandLine, Image, CommandLine, risk_score
| sort -risk_score, -_time

sequence by host.name, user.name with maxspan=2m
  [process where process.name : "WINWORD.EXE" and event.type == "start"]
  [process where process.parent.name : "WINWORD.EXE" and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                   "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
                   "bitsadmin.exe", "msiexec.exe", "curl.exe", "wget.exe")]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip, username, "Process Name", "Parent Process Name", "Command"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND ("Parent Process Name" ILIKE '%WINWORD.EXE'
       AND "Process Name" ILIKE ANY ('%cmd.exe','%powershell.exe','%wscript.exe',
                                      '%cscript.exe','%mshta.exe','%rundll32.exe',
                                      '%regsvr32.exe','%certutil.exe','%bitsadmin.exe',
                                      '%msiexec.exe'))
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=windows/sysmon EventID=1
| parse field=Message "ParentImage: *\n" as parent_image
| parse field=Message "Image: *\n" as child_image
| parse field=Message "CommandLine: *\n" as command_line
| parse field=Message "User: *\n" as user
| where parent_image matches "*WINWORD.EXE"
| where child_image matches "*cmd.exe" or child_image matches "*powershell.exe" or child_image matches "*wscript.exe" or child_image matches "*cscript.exe" or child_image matches "*mshta.exe" or child_image matches "*rundll32.exe" or child_image matches "*regsvr32.exe" or child_image matches "*certutil.exe" or child_image matches "*bitsadmin.exe"
| count by _sourceHost, user, parent_image, child_image, command_line
| sort by _count desc

rule cve_2026_21514_word_security_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Word spawning suspicious processes consistent with CVE-2026-21514 exploitation"
    severity = "HIGH"
    priority = "HIGH"
    cve = "CVE-2026-21514"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)WINWORD\.EXE$/
    $proc.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|msiexec)\.exe$/
    $proc.principal.hostname = $host

  condition:
    $proc
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName="WINWORD.EXE"
| search FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| eval risk=case(
    FileName="mshta.exe", "CRITICAL",
    FileName="regsvr32.exe", "HIGH",
    FileName="powershell.exe" AND CommandLine=~"(?i)-enc", "CRITICAL",
    FileName="certutil.exe", "HIGH",
    true(), "MEDIUM"
  )
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, risk
| sort -_time