Detect Microsoft Office Word Reliance on Untrusted Inputs in Security Decision (CVE-2026-21514) in Microsoft Sentinel
Detects exploitation of CVE-2026-21514, a Microsoft Office Word vulnerability classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This flaw allows attackers to manipulate security-relevant decisions in Word by supplying crafted untrusted input, potentially bypassing security controls such as Protected View, macro policy enforcement, or document trust decisions. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
MITRE ATT&CK
KQL Detection Query
let suspiciousWordChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ (suspiciousWordChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| union (
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FolderPath has_any ("\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\", "C:\\Windows\\Temp\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".vbs" or FileName endswith ".ps1" or FileName endswith ".hta"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
)
| union (
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where RemoteIPType !in ("Private", "Loopback")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
)
| sort by TimeGenerated descDetects Microsoft Word spawning suspicious child processes, writing executables to temp/appdata paths, or initiating external network connections — all indicators of security decision bypass exploitation consistent with CVE-2026-21514.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macro-enabled documents used by business teams that intentionally invoke cmd or PowerShell for automation
- IT-managed Word add-ins or templates that spawn helper processes as part of normal workflow
- Security tools or sandboxes that open Word documents and generate synthetic child process telemetry
- Word's built-in repair or crash recovery mechanisms spawning system utilities
Other platforms for CVE-2026-21514
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Word Spawns PowerShell via Macro — Security Bypass Simulation
Expected signal: Sysmon Event ID 1 showing WINWORD.EXE as ParentImage with powershell.exe as child Image; PowerShell ScriptBlock logging Event ID 4104; network telemetry if payload attempts outbound connection
- Test 2Word Drops Executable to Temp via Macro
Expected signal: Sysmon Event ID 11 (FileCreate) with Image=WINWORD.EXE and TargetFilename ending in .exe under %TEMP%; DeviceFileEvents in MDE showing InitiatingProcessFileName=WINWORD.EXE
- Test 3Word Initiates External Network Connection via mshta Child Process
Expected signal: Sysmon Event ID 1 with ParentImage=WINWORD.EXE and Image=mshta.exe; subsequent cmd.exe spawn from mshta.exe visible in process tree; file creation in TEMP
- Test 4Mark-of-the-Web Bypass Check — Simulated Internet-Origin Document Open
Expected signal: Sysmon Event ID 15 (FileCreateStreamHash) capturing Zone.Identifier ADS creation and deletion; Windows Defender SmartScreen or Office MOTW telemetry in event logs
Unlock Pro Content
Get the full detection package for CVE-2026-21514 including response playbook, investigation guide, and atomic red team tests.