Detect Exploitation for Client Execution in CrowdStrike LogScale
Adversaries may exploit software vulnerabilities in client applications to execute code. This includes browser-based exploitation via drive-by compromise or spearphishing links, Office application exploitation through malicious attachments (CVE-2017-11882, CVE-2017-0262, CVE-2021-40444), and third-party application exploitation (Adobe Reader, Flash). These exploits cause vulnerable client software to execute attacker-controlled code, often spawning unexpected child processes or injecting shellcode into memory.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1203 Exploitation for Client Execution
- Canonical reference
- https://attack.mitre.org/techniques/T1203/
LogScale Detection Query
#event_simpleName = ProcessRollup2
| ParentBaseFileName = /(?i)^(winword|excel|powerpnt|outlook|mspub|visio|onenote|msaccess|chrome|firefox|msedge|iexplore|opera|brave|acrord32|acrobat|foxitpdfeditor|sumatrapdf)\.exe$/
| FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|msbuild|installutil|regasm|regsvcs|schtasks|wmic|msiexec)\.exe$/
| ExploitVector := case {
ParentBaseFileName = /(?i)(winword|excel|powerpnt|outlook|mspub|visio|onenote|msaccess)\.exe/ => "Office Application";
ParentBaseFileName = /(?i)(chrome|firefox|msedge|iexplore|opera|brave)\.exe/ => "Browser";
ParentBaseFileName = /(?i)(acrord32|acrobat|foxit|sumatrapdf)\.exe/ => "PDF Reader";
* => "Other"
}
| HighRisk := if(FileName = /(?i)(powershell|pwsh|mshta|regsvr32|rundll32|wscript|cscript)\.exe$/, "true", "false")
| select([_time, ComputerName, UserName, ExploitVector, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, TargetProcessId, ContextProcessId, HighRisk])
| sort(field=_time, order=desc)CrowdStrike LogScale (Falcon) CQL query detecting T1203 client exploitation using ProcessRollup2 Falcon sensor events. Matches ParentBaseFileName (the direct parent process, a client application) against Office suite, browser, and PDF reader families, and FileName (the spawned child) against LOLBins and script interpreters. ProcessRollup2 events include accurate parent-child process lineage from kernel-level telemetry. ExploitVector classification and HighRisk flag support analyst triage prioritization in Falcon Investigate or LogScale dashboards.
Data Sources
Required Tables
False Positives & Tuning
- Helpdesk or RMM tool automation that uses Office COM interop to remotely invoke PowerShell or cmd.exe for managed endpoint diagnostics, software inventory, or configuration remediation on corporate workstations
- Enterprise browser extensions designed for privileged access management, hardware security key authentication, or smart card middleware that launch rundll32.exe to communicate with local PKCS11 or CCID drivers
- Adobe Acrobat Pro or Foxit enterprise license management and activation scripts that call certutil.exe or wscript.exe during seat management, certificate-based DRM enforcement, or volume license renewal tasks
Other platforms for T1203
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulate Office Exploitation — Equation Editor Child Process
Expected signal: Sysmon Event ID 1: Process Create with ParentImage containing eqnedt32.exe and Image=cmd.exe. Security Event ID 4688 with similar parent/child relationship if command line auditing enabled.
- Test 2 Office Application Spawning PowerShell via Macro Simulation
Expected signal: Sysmon Event ID 1: Process Create chain showing cmd.exe spawning powershell.exe. The detection focuses on the child process spawning pattern. PowerShell ScriptBlock Log Event ID 4104 will record the Write-Output command.
- Test 3 Browser Renderer Process Spawning Cmd
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with subsequent net.exe and whoami.exe child processes. This represents the reconnaissance commands commonly executed immediately following successful browser exploitation.
- Test 4 Mshta Spawned from Office Context (CVE-2021-40444 Pattern)
Expected signal: Sysmon Event ID 1: Process Create for mshta.exe. In real exploitation this process would have a parent of winword.exe or excel.exe. Security Event ID 4688 will also record the mshta.exe launch with command line arguments.
References (7)
- https://attack.mitre.org/techniques/T1203/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-11882
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1203/T1203.md
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.sentinelone.com/blog/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/
Response Playbook
Triage
- Identify the exploit vector — which application spawned the suspicious child process? Office (check attachment source), Browser (check browsing history/URL), or PDF Reader (check document source). This determines phishing vs drive-by vs targeted delivery.
- Examine the parent process command line — for Office exploits, look for eqnedt32.exe (Equation Editor, CVE-2017-11882), MSHTML rendering, or macro execution. Equation Editor should never spawn cmd.exe or PowerShell.
- Examine the child process command line — what is the spawned process executing? Encoded PowerShell, download cradles, or LOLBin abuse indicate active exploitation payload execution.
- Check the file that triggered the parent process — open DeviceFileEvents for the Office or PDF document: was it recently downloaded from the internet (Zone.Identifier ADS present), from email, or from a network share?
- Determine if code execution succeeded — look for additional child process generations (e.g., PowerShell spawning cmd.exe), new file drops in %TEMP%, %APPDATA%, or C:\Users\Public\, or new network connections.
- Assess the user account — was this a privileged account? Are there signs of lateral movement or credential access following the initial exploit?
Containment
- Immediately isolate the endpoint from the network using EDR network isolation if code execution is confirmed — exploitation often leads to rapid C2 establishment within seconds.
- Terminate the malicious child process chain if still running — kill the spawned cmd.exe, PowerShell, or other payload process to interrupt C2 establishment or lateral movement.
- Block the source file hash at the endpoint protection layer — if delivered via email attachment, pull the email from all recipients' inboxes and block the sender domain.
- If browser exploitation: block the source URL/domain at the web proxy and DNS security layer. Identify other users who visited the same URL within the same timeframe.
- Disable the vulnerable application version across the environment — trigger emergency patching for the identified CVE. Block eqnedt32.exe via AppLocker/WDAC if CVE-2017-11882 is confirmed.
- Reset credentials for the compromised user and any accounts accessed on the compromised endpoint — exploitation may have enabled credential harvesting.
Evidence Collection
- Source document — collect the Office document, PDF, or browser cache file that triggered the exploit. Preserve original Zone.Identifier ADS ($file:Zone.Identifier) to confirm internet origin and source URL.
- Process tree — capture full parent/child process chain with command lines from Sysmon Event ID 1 or Security Event ID 4688. Map all processes spawned within 5 minutes of the initial exploit.
- Sysmon Event ID 3 — network connections initiated by the exploitation chain. Look for connections from child processes (cmd.exe, PowerShell) within seconds of spawning.
- Sysmon Event ID 11 — file creation events from the Office/browser parent and all child processes. Document any dropped payloads in %TEMP%, %APPDATA%, C:\Windows\Temp\ or C:\ProgramData\.
- Sysmon Event ID 10 (ProcessAccess) — check for LSASS memory access attempts following the exploit, indicating credential dumping.
- Memory dump — if the exploit process (winword.exe, chrome.exe) is still running, capture a full memory dump for shellcode analysis. Use: procdump.exe -ma <pid> c:\evidence\
- Browser artifacts — if browser exploitation, collect browser history, downloads, and cache from %APPDATA%\Google\Chrome\User Data\Default\ or equivalent for URL reconstruction.
- Email artifacts — if phishing delivery, collect the original email headers (.eml format) from mail server logs or user mailbox for infrastructure attribution.
Escalation Criteria
- !Confirmed code execution with network connectivity — child process established outbound connection to external IP (C2 established, immediate IR engagement required).
- !Equation Editor (eqnedt32.exe) spawning any child process — this is almost always CVE-2017-11882 exploitation with no legitimate use case.
- !MSHTML/mshta.exe spawned by an Office application — indicates CVE-2021-40444 or similar MSHTML exploitation chain.
- !Post-exploitation tool execution — spawned process running Mimikatz, Cobalt Strike, Meterpreter, or similar framework payloads.
- !Multiple users affected by the same document hash or URL within a short timeframe — indicates active phishing campaign or watering hole attack requiring organization-wide response.
- !Privileged account (domain admin, service account) was the victim — expand scope of investigation to cover lateral movement and persistence mechanisms.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Zone.Identifier ADS — every downloaded file has a Zone.Identifier alternate data stream containing the source URL and zone (3=Internet). Check with: Get-Item <file> -Stream Zone.Identifier | Get-Content - >
Office Recent Documents — HKCU\Software\Microsoft\Office\<version>\<app>\File MRU lists recently opened documents with full paths and timestamps. - >
Prefetch files — C:\Windows\Prefetch\EQNEDT32.EXE-*.pf for Equation Editor; C:\Windows\Prefetch\WINWORD.EXE-*.pf for Word. Timestamps indicate exploitation events. - >
Windows Error Reporting — C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ — application crashes from exploit attempts that failed generate WER crash dumps useful for shellcode analysis. - >
Browser History — Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite). Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History. Records URLs of exploit delivery sites. - >
Outlook Attachments Cache — %LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Outlook\ — cached copies of email attachments including exploit documents. - >
AMSI ETW logs — Microsoft-Windows-AMSI/Operational (Event ID 1101, 1102) — records AMSI scan results for scripts executed by Office VBA and other AMSI-aware processes. - >
AppCompatCache (Shimcache) — HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — records executable path and last modification time for processes run during the exploit chain.
Tuning Guidance
The primary tuning challenge is legitimate macro usage in Office environments. Start by building a whitelist of known-good parent-child pairs: SCCM/Intune deployment scripts that deliberately invoke PowerShell from Office, and HR or finance automation tools that use Office macros to shell out. Baseline normal Equation Editor usage first — in most modern environments (Office 2019+), eqnedt32.exe should never run; any detection of it spawning children is true positive. For browser detections, focus on non-browser-subprocess children (chrome.exe spawning cmd.exe vs chrome.exe spawning chrome_crashpad_handler.exe). Exclude known browser child processes using a maintained allowlist. For high-volume environments, add a network connection correlator: only alert when the suspicious child process also makes an outbound network connection within 60 seconds, reducing false positives from macro testing. CVE-specific tuning: add dedicated rules for eqnedt32.exe (CVE-2017-11882), mshta.exe spawned from Office (CVE-2021-40444), and Adobe Reader spawning native processes (various CVEs) — these have near-zero false positive rates and can run at critical severity without threshold adjustments.
Hunting Queries
Hunt specifically for Equation Editor (eqnedt32.exe) spawning any child process — this is the hallmark of CVE-2017-11882 exploitation. Equation Editor has no legitimate reason to launch cmd.exe, PowerShell, or any scripting engine. Any result here is high confidence exploitation.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "eqnedt32.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\eqnedt32.exe"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for client applications making direct outbound network connections to public IPs on suspicious ports. Legitimate Office applications connect to Microsoft services; unexpected connections to non-Microsoft infrastructure (especially on ports like 4444, 8080, or non-standard ports) from these applications may indicate exploitation or post-exploitation C2 directly from the parent process.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "acrord32.exe", "acrobat.exe", "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
| where RemoteIPType == "Public"
| where RemotePort in (4444, 1234, 8080, 8443, 9001, 9002, 31337, 443, 80)
| summarize ConnectionCount=count(), UniqueIPs=dcount(RemoteIP), Ports=make_set(RemotePort) by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by ConnectionCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe" OR Image="*\\outlook.exe" OR Image="*\\acrord32.exe" OR Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe")
NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| stats count as ConnectionCount, dc(DestinationIp) as UniqueIPs, values(DestinationPort) as Ports by host, User, Image
| sort - ConnectionCountHunt for executable or script files dropped to user writable directories by client applications. Exploitation often results in a stage-2 payload being written to %TEMP% or %APPDATA% before execution. This query finds the file drop event, which can be correlated with subsequent process creation to confirm the full exploitation chain.
DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "acrord32.exe", "acrobat.exe", "eqnedt32.exe", "mshtml.dll")
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "C:\\Users\\Public\\", "C:\\Windows\\Temp\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".bat" or FileName endswith ".ps1" or FileName endswith ".vbs" or FileName endswith ".js"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe" OR Image="*\\outlook.exe" OR Image="*\\acrord32.exe" OR Image="*\\eqnedt32.exe")
(TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\AppData\\Roaming\\*" OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\Windows\\Temp\\*")
(TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.bat" OR TargetFilename="*.ps1" OR TargetFilename="*.vbs" OR TargetFilename="*.js")
| table _time, host, User, Image, TargetFilename, MD5
| sort - _timeAtomic Red Team Tests
Simulates the CVE-2017-11882 Equation Editor exploitation pattern by directly launching eqnedt32.exe (if present) and having it spawn cmd.exe. This mimics the child process relationship seen in real Equation Editor exploits without requiring an actual vulnerable document. Tests detection of the parent-child relationship that is the primary detection signal.
Command
cmd.exe /c "start /B C:\Program Files\Microsoft Office\root\Office16\eqnedt32.exe" && timeout /t 3 && cmd.exe /c whoami > %TEMP%\eqnedt32-test.txtCleanup
del %TEMP%\eqnedt32-test.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with ParentImage containing eqnedt32.exe and Image=cmd.exe. Security Event ID 4688 with similar parent/child relationship if command line auditing enabled.
Expected Detection
KQL query triggers on InitiatingProcessFileName=eqnedt32.exe spawning cmd.exe. SPL query triggers with ParentImage matching eqnedt32.exe and Image matching cmd.exe. ExploitVector will be classified as Equation Editor.
Uses cmd.exe to simulate the process tree created when an Office document exploit spawns PowerShell — the parent relationship of winword.exe→cmd.exe→powershell.exe is the canonical T1203 execution chain. This uses cmd.exe /c to set the parent PID context, simulating the chain without requiring a malicious document.
Command
powershell.exe -Command "$proc = Start-Process cmd.exe -ArgumentList '/c powershell.exe -NoProfile -Command Write-Output exploited > %TEMP%\t1203-test.txt' -PassThru; $proc.WaitForExit()"Cleanup
Remove-Item $env:TEMP\t1203-test.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create chain showing cmd.exe spawning powershell.exe. The detection focuses on the child process spawning pattern. PowerShell ScriptBlock Log Event ID 4104 will record the Write-Output command.
Expected Detection
SPL/KQL queries will detect powershell.exe spawned from cmd.exe. When combined with a real Office parent this would be high confidence; as a standalone test it validates the child process detection logic.
Simulates a browser-based exploitation result by launching a cmd.exe process with a browser-like parent context. Tests detection of cmd.exe execution patterns that would follow successful browser exploit code execution, without requiring an actual browser vulnerability.
Command
cmd.exe /c "echo T1203 browser exploit simulation > %TEMP%\browser-exploit-test.txt && whoami && net user"Cleanup
del %TEMP%\browser-exploit-test.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create for cmd.exe with subsequent net.exe and whoami.exe child processes. This represents the reconnaissance commands commonly executed immediately following successful browser exploitation.
Expected Detection
Detection fires on cmd.exe spawning discovery commands (whoami, net user). When the parent is a browser process this is high confidence T1203 followed by T1033/T1087 discovery activity.
Simulates the CVE-2021-40444 MSHTML exploitation pattern where Microsoft Office spawns mshta.exe to load a remote HTA payload. The mshta.exe execution with a remote URL is the key indicator for this vulnerability class. Uses localhost as the target URL for safety.
Command
mshta.exe "javascript:close();"Expected Telemetry
Sysmon Event ID 1: Process Create for mshta.exe. In real exploitation this process would have a parent of winword.exe or excel.exe. Security Event ID 4688 will also record the mshta.exe launch with command line arguments.
Expected Detection
KQL query detects mshta.exe in SuspiciousChildren list. SPL query matches mshta.exe in Image field. When InitiatingProcessFileName is an Office application, this is flagged as critical severity ExploitVector=Office Application.