Using Cortex XSOAR to Deal With MSHTML Zero-Day Vulnerability (CVE-2021-40444)

Technical contribution by Palo Alto Networks Security Architects Yarden Altmann and Ben Melamed.

There's a new Playbook for MSHTML Zero-Day Vulnerability (CVE-2021-40444)— aka Microsoft's MSHTML Remote Code Execution Vulnerability.

CVE-2021-4044 is a Zero-Day Vulnerability with the MSHTML engine that has been found vulnerable to arbitrary code execution by a specially crafted Microsoft Office document or rich text format file.

At the time of publishing, a patch does not exist for this vulnerability—but an exploit sample is publicly available and is being actively exploited in the wild. Attackers using this vulnerability can run malicious code on the victim’s endpoint through malformed Office documents.

As part of our Rapid Breach Response program Cortex XSOAR released a new pack and a playbook to handle this vulnerability: CVE-2021-40444 - MSHTML RCE.

This playbook includes the following tasks:

Collect related known indicators from several sources.
Indicators, Files and Process creation patterns hunting using PAN-OS, Cortex XDR and SIEM products.
Block indicators automatically or manually.
Provide Microsoft workarounds and detection capabilities.