CVE-2026-21514 Microsoft Sentinel · KQL

Detect Microsoft Office Word Reliance on Untrusted Inputs in Security Decision (CVE-2026-21514) in Microsoft Sentinel

Detects exploitation of CVE-2026-21514, a Microsoft Office Word vulnerability classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This flaw allows attackers to manipulate security-relevant decisions in Word by supplying crafted untrusted input, potentially bypassing security controls such as Protected View, macro policy enforcement, or document trust decisions. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let suspiciousWordChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ (suspiciousWordChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| union (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "WINWORD.EXE"
    | where FolderPath has_any ("\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\", "C:\\Windows\\Temp\\")
    | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".vbs" or FileName endswith ".ps1" or FileName endswith ".hta"
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
)
| union (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "WINWORD.EXE"
    | where RemoteIPType !in ("Private", "Loopback")
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
)
| sort by TimeGenerated desc
high severity high confidence

Detects Microsoft Word spawning suspicious child processes, writing executables to temp/appdata paths, or initiating external network connections — all indicators of security decision bypass exploitation consistent with CVE-2026-21514.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel DeviceProcessEventsDeviceFileEventsDeviceNetworkEvents

Required Tables

DeviceProcessEventsDeviceFileEventsDeviceNetworkEvents

False Positives & Tuning

  • Legitimate macro-enabled documents used by business teams that intentionally invoke cmd or PowerShell for automation
  • IT-managed Word add-ins or templates that spawn helper processes as part of normal workflow
  • Security tools or sandboxes that open Word documents and generate synthetic child process telemetry
  • Word's built-in repair or crash recovery mechanisms spawning system utilities

Other platforms for CVE-2026-21514

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Word Spawns PowerShell via Macro — Security Bypass Simulation

    Expected signal: Sysmon Event ID 1 showing WINWORD.EXE as ParentImage with powershell.exe as child Image; PowerShell ScriptBlock logging Event ID 4104; network telemetry if payload attempts outbound connection

  2. Test 2Word Drops Executable to Temp via Macro

    Expected signal: Sysmon Event ID 11 (FileCreate) with Image=WINWORD.EXE and TargetFilename ending in .exe under %TEMP%; DeviceFileEvents in MDE showing InitiatingProcessFileName=WINWORD.EXE

  3. Test 3Word Initiates External Network Connection via mshta Child Process

    Expected signal: Sysmon Event ID 1 with ParentImage=WINWORD.EXE and Image=mshta.exe; subsequent cmd.exe spawn from mshta.exe visible in process tree; file creation in TEMP

  4. Test 4Mark-of-the-Web Bypass Check — Simulated Internet-Origin Document Open

    Expected signal: Sysmon Event ID 15 (FileCreateStreamHash) capturing Zone.Identifier ADS creation and deletion; Windows Defender SmartScreen or Office MOTW telemetry in event logs

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the user account and endpoint involved; determine whether the document was received via email, downloaded from the web, or opened from a file share — check mail gateway logs, browser download history, and SMB access logs.
  2. Examine the child process command line in full detail: look for encoded PowerShell (-EncodedCommand/-enc), remote URLs (http/https), or file paths pointing to %TEMP%, %APPDATA%, or %ProgramData% indicating a dropper stage.
  3. Check whether Protected View was active at the time of document open — query Office telemetry or registry (HKCU\Software\Microsoft\Office\<version>\Word\Security) to determine if macros or external content were allowed despite policy.
  4. Correlate the triggering document hash against VirusTotal, internal threat intel, or sandbox detonation results to assess whether it is a known malicious payload.
  5. Review network connections initiated by WINWORD.EXE or its child processes in the minutes following document open — flag any connections to external IPs or domains not in your enterprise allowlist.

Containment

  1. Isolate the affected endpoint immediately via EDR (CrowdStrike RTR, Defender for Endpoint Isolate, or equivalent) to prevent lateral movement or C2 beacon establishment.
  2. Revoke active sessions and reset credentials for the affected user account, particularly if the child process attempted LSASS access, credential dumping tools were detected, or any network authentication events followed the initial process chain.
  3. Block the source document hash at the email gateway, web proxy, and endpoint AV/EDR to prevent reinfection of other users who may have received the same file.

Evidence Collection

  1. Collect a full memory image (RAM dump) from the affected endpoint using WinPmem or EDR live response before any remediation actions, as exploit shellcode and injected payloads may only exist in memory.
  2. Preserve all relevant Windows Event Logs (Security, System, Application, Sysmon), prefetch files, NTFS $MFT, and any files written to %TEMP% or %APPDATA% during the incident window — package with timeline using Velociraptor or KAPE.
  3. Retrieve the originating Word document and any secondary payloads dropped to disk; capture network PCAP if available from the endpoint or perimeter for command-and-control traffic analysis.

Escalation Criteria

  • !Escalate to Incident Response if any child process performs credential access (LSASS dump, mimikatz indicators, SAM/NTDS access), if lateral movement indicators are detected (remote SMB, PsExec, WMI), or if C2 beaconing to an external IP is confirmed.
  • !Escalate if multiple endpoints in the environment show the same pattern within a short window, indicating a phishing campaign or worm-like spread, or if the affected user has privileged access (domain admin, service account, executive).

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Windows Prefetch for WINWORD.EXE and any child processes (C:\Windows\Prefetch\) — timestamps reveal execution time
  • >LNK files and Jump Lists in %APPDATA%\Microsoft\Windows\Recent\ pointing to the malicious document
  • >Office Trust Records in registry: HKCU\Software\Microsoft\Office\<version>\Word\Security\Trusted Documents
  • >Zone.Identifier ADS on the downloaded document (Mark-of-the-Web) confirming internet origin and bypass attempts
  • >Sysmon Event ID 1 (process create), 3 (network connect), 11 (file create) around the time of exploitation
  • >Windows Defender or AV quarantine logs for any secondary payloads dropped by the child process

Tuning Guidance

Start by establishing a baseline of approved Word-spawned processes in your environment by reviewing 30 days of historical data before alerting. Whitelist known-good parent-child pairs (e.g., Word spawning a specific IT-managed add-in helper) by hash or signed publisher rather than by process name. Apply time-of-day and user-role filters to reduce noise from developers or power users with legitimate scripting needs. Consider deploying ASR (Attack Surface Reduction) rule 'Block Office applications from creating child processes' (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) as a compensating control — this will generate additional telemetry and may eliminate many false positive scenarios by blocking benign automation that is not truly needed.

Hunting Queries

Hunt for WINWORD.EXE writing executable or script files to writable user-accessible paths, a strong indicator of dropper stage execution following security bypass

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\", "C:\\Windows\\Temp\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".vbs" or FileName endswith ".bat" or FileName endswith ".ps1" or FileName endswith ".hta"
| summarize FileCount=count(), Files=make_set(FileName) by DeviceName, AccountName, FolderPath
| where FileCount > 0
| sort by FileCount desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| where process LIKE "%WINWORD.EXE"
| where TargetFilename LIKE "%AppData%" OR TargetFilename LIKE "%Temp%" OR TargetFilename LIKE "%ProgramData%"
| where TargetFilename LIKE "%.exe" OR TargetFilename LIKE "%.dll" OR TargetFilename LIKE "%.vbs" OR TargetFilename LIKE "%.ps1" OR TargetFilename LIKE "%.hta"
| stats count by host, user, TargetFilename
| sort -count

Hunt for WINWORD.EXE establishing direct outbound connections to external IPs, which is anomalous for standard document use and may indicate C2 or payload download

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where RemoteIPType !in ("Private", "Loopback", "LinkLocal")
| summarize ConnectionCount=count(), Ports=make_set(RemotePort), RemoteIPs=make_set(RemoteIP) by DeviceName, AccountName, InitiatingProcessFileName
| where ConnectionCount > 0
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3
| where Image LIKE "%WINWORD.EXE"
| where NOT (DestinationIp LIKE "10.%" OR DestinationIp LIKE "192.168.%" OR DestinationIp LIKE "172.1%" OR DestinationIp LIKE "127.%")
| stats count by host, user, DestinationIp, DestinationPort
| sort -count

Atomic Red Team Tests

Test 1 Word Spawns PowerShell via Macro — Security Bypass Simulation
windows

Simulates exploitation of CVE-2026-21514 by running a Word macro that spawns PowerShell with an encoded command, mimicking the pattern of a security decision bypass leading to script execution.

Command

powershell 
powershell -Command "$word = New-Object -ComObject Word.Application; $word.Visible = $false; $doc = $word.Documents.Add(); $macro = $doc.VBProject.VBComponents.Add(1); $macro.CodeModule.AddFromString('Sub AutoOpen()\nShell \"powershell.exe -NonInteractive -EncodedCommand JABuAGUAdAAgAD0AIABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACAAdwByAGkAdABlAC0AaABvAHMAdAAgACcAYwB2AGUALQAyADAAMgA2AC0AMgAxADUAMQA0AC0AdABlAHMAdAAnAA==\"\nEnd Sub'); $word.Run('AutoOpen'); Start-Sleep 3; $doc.Close($false); $word.Quit()"

Cleanup

powershell 
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue; Stop-Process -Name WINWORD -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing WINWORD.EXE as ParentImage with powershell.exe as child Image; PowerShell ScriptBlock logging Event ID 4104; network telemetry if payload attempts outbound connection

Expected Detection

All seven detection queries should fire on the WINWORD.EXE → powershell.exe process creation event with encoded command-line

Test 2 Word Drops Executable to Temp via Macro
windows

Simulates the dropper phase of CVE-2026-21514 exploitation by having a Word macro write a benign executable stub to the user's TEMP directory, triggering file write detection rules.

Command

powershell 
powershell -Command "$word = New-Object -ComObject Word.Application; $word.Visible = $false; $doc = $word.Documents.Add(); $macro = $doc.VBProject.VBComponents.Add(1); $macro.CodeModule.AddFromString('Sub AutoOpen()\nDim fso As Object\nSet fso = CreateObject(\"Scripting.FileSystemObject\")\nfso.CopyFile \"C:\\Windows\\System32\\calc.exe\", Environ(\"TEMP\") & \"\\update_payload.exe\"\nEnd Sub'); $word.Run('AutoOpen'); Start-Sleep 2; $doc.Close($false); $word.Quit()"

Cleanup

powershell 
Remove-Item -Path "$env:TEMP\update_payload.exe" -Force -ErrorAction SilentlyContinue; Stop-Process -Name WINWORD -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) with Image=WINWORD.EXE and TargetFilename ending in .exe under %TEMP%; DeviceFileEvents in MDE showing InitiatingProcessFileName=WINWORD.EXE

Expected Detection

File write hunting queries in KQL and SPL should trigger; EDR file creation alerts for executable dropped by Office process

Test 3 Word Initiates External Network Connection via mshta Child Process
windows

Simulates a second-stage network beacon by having Word spawn mshta.exe with an external URL argument, representative of post-exploitation C2 or payload retrieval following a security bypass.

Command

powershell 
powershell -Command "$word = New-Object -ComObject Word.Application; $word.Visible = $false; $doc = $word.Documents.Add(); $macro = $doc.VBProject.VBComponents.Add(1); $macro.CodeModule.AddFromString('Sub AutoOpen()\nShell \"mshta.exe vbscript:Close(CreateObject(\"WScript.Shell\").Run(\"cmd /c echo cve-2026-21514-test > %TEMP%\\cve_test.txt\",0,True))\"\nEnd Sub'); $word.Run('AutoOpen'); Start-Sleep 3; $doc.Close($false); $word.Quit()"

Cleanup

powershell 
Remove-Item -Path "$env:TEMP\cve_test.txt" -Force -ErrorAction SilentlyContinue; Stop-Process -Name mshta -Force -ErrorAction SilentlyContinue; Stop-Process -Name WINWORD -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with ParentImage=WINWORD.EXE and Image=mshta.exe; subsequent cmd.exe spawn from mshta.exe visible in process tree; file creation in TEMP

Expected Detection

All process-chain detection rules should trigger on WINWORD.EXE → mshta.exe; risk score should be rated CRITICAL in CrowdStrike CQL and SPL eval logic

Test 4 Mark-of-the-Web Bypass Check — Simulated Internet-Origin Document Open
windows

Validates that zone identifier (MOTW) is present or absent on a document and tests whether security controls fire when a Zone.Identifier ADS-stripped document is opened — simulating the untrusted input manipulation core to CVE-2026-21514.

Command

powershell 
powershell -Command "$testDoc = '$env:TEMP\cve_test_motw.docx'; New-Item -Path $testDoc -ItemType File -Force | Out-Null; Set-Content -Path ($testDoc + ':Zone.Identifier') -Value '[ZoneTransfer]`nZoneId=3'; Write-Host 'Zone.Identifier set to ZoneId=3 (Internet)'; $adsContent = Get-Content ($testDoc + ':Zone.Identifier'); Write-Host 'ADS Content:'; Write-Host $adsContent; Remove-Item -Path ($testDoc + ':Zone.Identifier') -Force; $adsAfter = Get-Content ($testDoc + ':Zone.Identifier') -ErrorAction SilentlyContinue; if (-not $adsAfter) { Write-Host 'MOTW stripped — document would open without Protected View warning' }"

Cleanup

powershell 
Remove-Item -Path "$env:TEMP\cve_test_motw.docx" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 15 (FileCreateStreamHash) capturing Zone.Identifier ADS creation and deletion; Windows Defender SmartScreen or Office MOTW telemetry in event logs

Expected Detection

EDR and SIEM rules monitoring for ADS strip events on Office document file types; Office telemetry showing Protected View bypass for internet-origin documents

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1566.001Spearphishing AttachmentT1204.002Malicious FileT1553Subvert Trust ControlsT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections