Using Cortex XSOAR to Deal With MSHTML Zero-Day Vulnerability (CVE-2021-40444)

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Community Team Member

Using Cortex XSOAR to Deal With MSHTML Zero-Day Vulnerability (CVE-2021-40444)Using Cortex XSOAR to Deal With MSHTML Zero-Day Vulnerability (CVE-2021-40444)


Technical contribution by Palo Alto Networks Security Architects Yarden Altmann and Ben Melamed.

There's a new Playbook for MSHTML Zero-Day Vulnerability (CVE-2021-40444)— aka Microsoft's MSHTML Remote Code Execution Vulnerability


CVE-2021-4044 is a Zero-Day Vulnerability with the MSHTML engine that has been found vulnerable to arbitrary code execution by a specially crafted Microsoft Office document or rich text format file.


At the time of publishing, a patch does not exist for this vulnerability—but an exploit sample is publicly available and is being actively exploited in the wild. Attackers using this vulnerability can run malicious code on the victim’s endpoint through malformed Office documents.


As part of our Rapid Breach Response program Cortex XSOAR released a new pack and a playbook to handle this vulnerability: CVE-2021-40444 - MSHTML RCE.


This playbook includes the following tasks: 


  • Collect related known indicators from several sources.
  • Indicators, Files and Process creation patterns hunting using PAN-OS, Cortex XDR and SIEM products.
  • Block indicators automatically or manually.
  • Provide Microsoft workarounds and detection capabilities.






Read the Cortex XSOAR playbook CVE-2021-40444 - MSHTML RCE now, and find further information on the Cortex XSOAR technology page.



Register or Sign-in