
Summary
The Office Spawning Control analytic has been deprecated but was designed to identify situations where `control.exe` is executed by various Microsoft Office products like Word, Excel, and PowerPoint. This behavior was significant as it could indicate attempts to exploit vulnerabilities such as CVE-2021-40444, where `control.exe` is capable of executing malicious .cpl or .inf files. The detection relied on correlating process relationships within EDR data, including monitoring specific parent and child process interactions. If identified and confirmed as malicious, such activities could lead to unauthorized code execution, compromising the system, exfiltrating data, or facilitating further intrusions within the network.
Categories
- Endpoint
- Windows
Data Sources
- Windows Registry
- Process
- Logon Session
ATT&CK Techniques
- T1218
- T1218.002
- T1566
- T1566.001
Created: 2025-01-24