KQL Search

//CVE-2021-40444 hunting. Find device mshtml image load events initiated by common Office executables, then retrieve process events from the device in the same time period where the initiating process is an Office executable, but the process is different

//Data connector required for this query - M365 Defender - Device* tables or Advanced Hunting license

let process = dynamic(["winword.exe", "wordview.exe", "wordpad.exe", "powerpnt.exe", "excel.exe"]);
DeviceImageLoadEvents
| where FileName in ("mshtml.dll", "Microsoft.mshtml.dll")
| where InitiatingProcessFileName in~ (process) 
| project ImageLoadTime=TimeGenerated, DeviceName, InitiatingProcessFolderPath, 
    InitiatingProcessParentFileName, InitiatingProcessParentCreationTime, 
    InitiatingProcessCommandLine
| join kind=inner (
    DeviceProcessEvents)
    on DeviceName
| extend ProcessTime = TimeGenerated
| extend FileNameLower = tolower(FileName)
| extend InitiatingFileNameLower = tolower(InitiatingProcessFileName)
| where InitiatingProcessFileName in~ (process)
| where FileNameLower != InitiatingFileNameLower
| where ProcessTime between ((ImageLoadTime-timespan(5min)).. (ImageLoadTime+timespan(5min)))
| project ImageLoadTime, ProcessTime, DeviceName, InitiatingProcessFileName, FileName