Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. This includes browser-based exploitation via drive-by compromise or spearphishing links, Office application exploitation through malicious attachments (CVE-2017-11882, CVE-2017-0262, CVE-2021-40444), and third-party application exploitation (Adobe Reader, Flash). These exploits cause vulnerable client software to execute attacker-controlled code, often spawning unexpected child processes or injecting shellcode into memory.
What is T1203 Exploitation for Client Execution?
Exploitation for Client Execution (T1203) maps to the Execution tactic — the adversary is trying to run malicious code in MITRE ATT&CK.
This page provides production-ready detection logic for Exploitation for Client Execution, covering the data sources and telemetry it touches: Process: Process Creation, Microsoft Defender for Endpoint, Command: Command Execution. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1203 Exploitation for Client Execution
- Canonical reference
- https://attack.mitre.org/techniques/T1203/
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mspub.exe", "visio.exe", "onenote.exe", "msaccess.exe"]);
let BrowserApps = dynamic(["chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "opera.exe", "brave.exe"]);
let PDFApps = dynamic(["acrord32.exe", "acrobat.exe", "foxit reader.exe", "foxitpdfeditor.exe", "sumatrapdf.exe"]);
let SuspiciousChildren = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
"msbuild.exe", "installutil.exe", "regasm.exe", "regsvcs.exe",
"schtasks.exe", "at.exe", "wmic.exe", "msiexec.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any (OfficeApps)
or InitiatingProcessFileName has_any (BrowserApps)
or InitiatingProcessFileName has_any (PDFApps)
| where FileName has_any (SuspiciousChildren)
| extend ExploitVector = case(
InitiatingProcessFileName has_any (OfficeApps), "Office Application",
InitiatingProcessFileName has_any (BrowserApps), "Browser",
InitiatingProcessFileName has_any (PDFApps), "PDF Reader",
"Other"
)
| extend HighRisk = FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, ExploitVector,
InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, FolderPath, HighRisk,
InitiatingProcessParentFileName
| sort by Timestamp descDetects client application exploitation by identifying suspicious child process spawning from Office applications, browsers, and PDF readers. Monitors for exploitation payloads including CVE-2017-11882 (Equation Editor), CVE-2021-40444 (MSHTML), and browser exploit chains that spawn cmd.exe, PowerShell, LOLBins, or scripting engines. Flags high-risk child processes for prioritization.
Data Sources
Required Tables
False Positives
- Office macros legitimately launching PowerShell or cmd.exe for automation tasks (SCCM, IT scripts embedded in documents)
- Browser helper objects or extensions that spawn child processes for download handling or media playback
- PDF readers launching external viewers or handlers for embedded attachments (e.g., opening an Excel file embedded in a PDF)
- Equation Editor (eqnedt32.exe) being spawned during legitimate document rendering on older Office versions
- Developer tools or IDE integrations within browsers that spawn terminal processes
Sigma rule & cross-platform mapping
The detection logic for Exploitation for Client Execution (T1203) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1203
References (7)
- https://attack.mitre.org/techniques/T1203/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-11882
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1203/T1203.md
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.sentinelone.com/blog/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Office Exploitation — Equation Editor Child Process
Expected signal: Sysmon Event ID 1: Process Create with ParentImage containing eqnedt32.exe and Image=cmd.exe. Security Event ID 4688 with similar parent/child relationship if command line auditing enabled.
- Test 2Office Application Spawning PowerShell via Macro Simulation
Expected signal: Sysmon Event ID 1: Process Create chain showing cmd.exe spawning powershell.exe. The detection focuses on the child process spawning pattern. PowerShell ScriptBlock Log Event ID 4104 will record the Write-Output command.
- Test 3Browser Renderer Process Spawning Cmd
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with subsequent net.exe and whoami.exe child processes. This represents the reconnaissance commands commonly executed immediately following successful browser exploitation.
- Test 4Mshta Spawned from Office Context (CVE-2021-40444 Pattern)
Expected signal: Sysmon Event ID 1: Process Create for mshta.exe. In real exploitation this process would have a parent of winword.exe or excel.exe. Security Event ID 4688 will also record the mshta.exe launch with command line arguments.
Response Playbook
Triage
- Identify the exploit vector — which application spawned the suspicious child process? Office (check attachment source), Browser (check browsing history/URL), or PDF Reader (check document source). This determines phishing vs drive-by vs targeted delivery.
- Examine the parent process command line — for Office exploits, look for eqnedt32.exe (Equation Editor, CVE-2017-11882), MSHTML rendering, or macro execution. Equation Editor should never spawn cmd.exe or PowerShell.
- Examine the child process command line — what is the spawned process executing? Encoded PowerShell, download cradles, or LOLBin abuse indicate active exploitation payload execution.
- Check the file that triggered the parent process — open DeviceFileEvents for the Office or PDF document: was it recently downloaded from the internet (Zone.Identifier ADS present), from email, or from a network share?
- Determine if code execution succeeded — look for additional child process generations (e.g., PowerShell spawning cmd.exe), new file drops in %TEMP%, %APPDATA%, or C:\Users\Public\, or new network connections.
- Assess the user account — was this a privileged account? Are there signs of lateral movement or credential access following the initial exploit?
Containment
- Immediately isolate the endpoint from the network using EDR network isolation if code execution is confirmed — exploitation often leads to rapid C2 establishment within seconds.
- Terminate the malicious child process chain if still running — kill the spawned cmd.exe, PowerShell, or other payload process to interrupt C2 establishment or lateral movement.
- Block the source file hash at the endpoint protection layer — if delivered via email attachment, pull the email from all recipients' inboxes and block the sender domain.
- If browser exploitation: block the source URL/domain at the web proxy and DNS security layer. Identify other users who visited the same URL within the same timeframe.
- Disable the vulnerable application version across the environment — trigger emergency patching for the identified CVE. Block eqnedt32.exe via AppLocker/WDAC if CVE-2017-11882 is confirmed.
- Reset credentials for the compromised user and any accounts accessed on the compromised endpoint — exploitation may have enabled credential harvesting.
Evidence Collection
- Source document — collect the Office document, PDF, or browser cache file that triggered the exploit. Preserve original Zone.Identifier ADS ($file:Zone.Identifier) to confirm internet origin and source URL.
- Process tree — capture full parent/child process chain with command lines from Sysmon Event ID 1 or Security Event ID 4688. Map all processes spawned within 5 minutes of the initial exploit.
- Sysmon Event ID 3 — network connections initiated by the exploitation chain. Look for connections from child processes (cmd.exe, PowerShell) within seconds of spawning.
- Sysmon Event ID 11 — file creation events from the Office/browser parent and all child processes. Document any dropped payloads in %TEMP%, %APPDATA%, C:\Windows\Temp\ or C:\ProgramData\.
- Sysmon Event ID 10 (ProcessAccess) — check for LSASS memory access attempts following the exploit, indicating credential dumping.
- Memory dump — if the exploit process (winword.exe, chrome.exe) is still running, capture a full memory dump for shellcode analysis. Use: procdump.exe -ma <pid> c:\evidence\
- Browser artifacts — if browser exploitation, collect browser history, downloads, and cache from %APPDATA%\Google\Chrome\User Data\Default\ or equivalent for URL reconstruction.
- Email artifacts — if phishing delivery, collect the original email headers (.eml format) from mail server logs or user mailbox for infrastructure attribution.
Escalation Criteria
- ! Confirmed code execution with network connectivity — child process established outbound connection to external IP (C2 established, immediate IR engagement required).
- ! Equation Editor (eqnedt32.exe) spawning any child process — this is almost always CVE-2017-11882 exploitation with no legitimate use case.
- ! MSHTML/mshta.exe spawned by an Office application — indicates CVE-2021-40444 or similar MSHTML exploitation chain.
- ! Post-exploitation tool execution — spawned process running Mimikatz, Cobalt Strike, Meterpreter, or similar framework payloads.
- ! Multiple users affected by the same document hash or URL within a short timeframe — indicates active phishing campaign or watering hole attack requiring organization-wide response.
- ! Privileged account (domain admin, service account) was the victim — expand scope of investigation to cover lateral movement and persistence mechanisms.
Investigation Guide
Forensic Artifacts
- >
Zone.Identifier ADS — every downloaded file has a Zone.Identifier alternate data stream containing the source URL and zone (3=Internet). Check with: Get-Item <file> -Stream Zone.Identifier | Get-Content - >
Office Recent Documents — HKCU\Software\Microsoft\Office\<version>\<app>\File MRU lists recently opened documents with full paths and timestamps. - >
Prefetch files — C:\Windows\Prefetch\EQNEDT32.EXE-*.pf for Equation Editor; C:\Windows\Prefetch\WINWORD.EXE-*.pf for Word. Timestamps indicate exploitation events. - >
Windows Error Reporting — C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ — application crashes from exploit attempts that failed generate WER crash dumps useful for shellcode analysis. - >
Browser History — Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite). Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History. Records URLs of exploit delivery sites. - >
Outlook Attachments Cache — %LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Outlook\ — cached copies of email attachments including exploit documents. - >
AMSI ETW logs — Microsoft-Windows-AMSI/Operational (Event ID 1101, 1102) — records AMSI scan results for scripts executed by Office VBA and other AMSI-aware processes. - >
AppCompatCache (Shimcache) — HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — records executable path and last modification time for processes run during the exploit chain.
Tuning Guidance
The primary tuning challenge is legitimate macro usage in Office environments. Start by building a whitelist of known-good parent-child pairs: SCCM/Intune deployment scripts that deliberately invoke PowerShell from Office, and HR or finance automation tools that use Office macros to shell out. Baseline normal Equation Editor usage first — in most modern environments (Office 2019+), eqnedt32.exe should never run; any detection of it spawning children is true positive. For browser detections, focus on non-browser-subprocess children (chrome.exe spawning cmd.exe vs chrome.exe spawning chrome_crashpad_handler.exe). Exclude known browser child processes using a maintained allowlist. For high-volume environments, add a network connection correlator: only alert when the suspicious child process also makes an outbound network connection within 60 seconds, reducing false positives from macro testing. CVE-specific tuning: add dedicated rules for eqnedt32.exe (CVE-2017-11882), mshta.exe spawned from Office (CVE-2021-40444), and Adobe Reader spawning native processes (various CVEs) — these have near-zero false positive rates and can run at critical severity without threshold adjustments.
Hunting Queries
Hunt specifically for Equation Editor (eqnedt32.exe) spawning any child process — this is the hallmark of CVE-2017-11882 exploitation. Equation Editor has no legitimate reason to launch cmd.exe, PowerShell, or any scripting engine. Any result here is high confidence exploitation.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "eqnedt32.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\eqnedt32.exe"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for client applications making direct outbound network connections to public IPs on suspicious ports. Legitimate Office applications connect to Microsoft services; unexpected connections to non-Microsoft infrastructure (especially on ports like 4444, 8080, or non-standard ports) from these applications may indicate exploitation or post-exploitation C2 directly from the parent process.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "acrord32.exe", "acrobat.exe", "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
| where RemoteIPType == "Public"
| where RemotePort in (4444, 1234, 8080, 8443, 9001, 9002, 31337, 443, 80)
| summarize ConnectionCount=count(), UniqueIPs=dcount(RemoteIP), Ports=make_set(RemotePort) by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by ConnectionCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe" OR Image="*\\outlook.exe" OR Image="*\\acrord32.exe" OR Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe")
NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| stats count as ConnectionCount, dc(DestinationIp) as UniqueIPs, values(DestinationPort) as Ports by host, User, Image
| sort - ConnectionCountHunt for executable or script files dropped to user writable directories by client applications. Exploitation often results in a stage-2 payload being written to %TEMP% or %APPDATA% before execution. This query finds the file drop event, which can be correlated with subsequent process creation to confirm the full exploitation chain.
DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "acrord32.exe", "acrobat.exe", "eqnedt32.exe", "mshtml.dll")
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "C:\\Users\\Public\\", "C:\\Windows\\Temp\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".bat" or FileName endswith ".ps1" or FileName endswith ".vbs" or FileName endswith ".js"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe" OR Image="*\\outlook.exe" OR Image="*\\acrord32.exe" OR Image="*\\eqnedt32.exe")
(TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\AppData\\Roaming\\*" OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\Windows\\Temp\\*")
(TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.bat" OR TargetFilename="*.ps1" OR TargetFilename="*.vbs" OR TargetFilename="*.js")
| table _time, host, User, Image, TargetFilename, MD5
| sort - _timeAtomic Red Team Tests
Simulates the CVE-2017-11882 Equation Editor exploitation pattern by directly launching eqnedt32.exe (if present) and having it spawn cmd.exe. This mimics the child process relationship seen in real Equation Editor exploits without requiring an actual vulnerable document. Tests detection of the parent-child relationship that is the primary detection signal.
Command
cmd.exe /c "start /B C:\Program Files\Microsoft Office\root\Office16\eqnedt32.exe" && timeout /t 3 && cmd.exe /c whoami > %TEMP%\eqnedt32-test.txtCleanup
del %TEMP%\eqnedt32-test.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with ParentImage containing eqnedt32.exe and Image=cmd.exe. Security Event ID 4688 with similar parent/child relationship if command line auditing enabled.
Expected Detection
KQL query triggers on InitiatingProcessFileName=eqnedt32.exe spawning cmd.exe. SPL query triggers with ParentImage matching eqnedt32.exe and Image matching cmd.exe. ExploitVector will be classified as Equation Editor.
Uses cmd.exe to simulate the process tree created when an Office document exploit spawns PowerShell — the parent relationship of winword.exe→cmd.exe→powershell.exe is the canonical T1203 execution chain. This uses cmd.exe /c to set the parent PID context, simulating the chain without requiring a malicious document.
Command
powershell.exe -Command "$proc = Start-Process cmd.exe -ArgumentList '/c powershell.exe -NoProfile -Command Write-Output exploited > %TEMP%\t1203-test.txt' -PassThru; $proc.WaitForExit()"Cleanup
Remove-Item $env:TEMP\t1203-test.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create chain showing cmd.exe spawning powershell.exe. The detection focuses on the child process spawning pattern. PowerShell ScriptBlock Log Event ID 4104 will record the Write-Output command.
Expected Detection
SPL/KQL queries will detect powershell.exe spawned from cmd.exe. When combined with a real Office parent this would be high confidence; as a standalone test it validates the child process detection logic.
Simulates a browser-based exploitation result by launching a cmd.exe process with a browser-like parent context. Tests detection of cmd.exe execution patterns that would follow successful browser exploit code execution, without requiring an actual browser vulnerability.
Command
cmd.exe /c "echo T1203 browser exploit simulation > %TEMP%\browser-exploit-test.txt && whoami && net user"Cleanup
del %TEMP%\browser-exploit-test.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create for cmd.exe with subsequent net.exe and whoami.exe child processes. This represents the reconnaissance commands commonly executed immediately following successful browser exploitation.
Expected Detection
Detection fires on cmd.exe spawning discovery commands (whoami, net user). When the parent is a browser process this is high confidence T1203 followed by T1033/T1087 discovery activity.
Simulates the CVE-2021-40444 MSHTML exploitation pattern where Microsoft Office spawns mshta.exe to load a remote HTA payload. The mshta.exe execution with a remote URL is the key indicator for this vulnerability class. Uses localhost as the target URL for safety.
Command
mshta.exe "javascript:close();"Expected Telemetry
Sysmon Event ID 1: Process Create for mshta.exe. In real exploitation this process would have a parent of winword.exe or excel.exe. Security Event ID 4688 will also record the mshta.exe launch with command line arguments.
Expected Detection
KQL query detects mshta.exe in SuspiciousChildren list. SPL query matches mshta.exe in Image field. When InitiatingProcessFileName is an Office application, this is flagged as critical severity ExploitVector=Office Application.