Coverage › CVE-2021-21017

CVE-2021-21017 Mapped Sigma

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Vendor / product: Adobe — Acrobat and Reader
Description (CISA): Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Added to KEV: 2021-11-03
Due date: 2021-11-17
Required action: Apply updates per vendor instructions.
Known ransomware use: Unknown
CWE: CWE-122
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2021-21017
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1204.002 Malicious File	exploitation technique	This exploit requires a user to open a malicious file. It can then result in execution of arbitrary code which could have any number of impacts. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1204.002 Malicious File exploitation technique

DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
AN0819 Windows
User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList

AN0820 macOS
User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

Tunable: TimeWindow QuarantineRequired ParentApps

AN0821 Linux
User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation
auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

Tunable: TimeWindow DesktopParentMap

Sigma rules tagged `attack.t1204.002` (39)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Potential Suspicious Browser Launch From Document Reader Process mediumtest

Author: Joseph Kamau · 2024-05-27 (modified 2025-10-07) · logsource: product=windows category=process_creation · 1193d960-2369-499f-a158-7b50a31df682

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Techniques: T1204.002

Microsoft Word Add-In Loaded lowtest

Author: Steffen Rogge (dr0pd34d) · 2024-07-10 · logsource: product=windows category=image_load · 1337afba-d17d-4d23-bd55-29b927603b30

Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.

Techniques: T1204.002

Suspicious Outlook Child Process hightest

Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team · 2022-02-28 (modified 2023-02-04) · logsource: product=windows category=process_creation · 208748f7-881d-47ac-a29c-07ea84bf691d

Detects a suspicious process spawning from an Outlook process.

Techniques: T1204.002

Suspicious Startup Folder Persistence hightest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Techniques: T1204.002 T1547.001

Successful MSIX/AppX Package Installation lowexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · 289dfa9e-e378-4a56-a9d4-7ed5ee218029

Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. While most installations are legitimate, this can help identify unauthorized or suspicious package installations. It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.

Techniques: T1204.002

Potential Maze Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052

Detects specific process characteristics of Maze ransomware word document droppers

Techniques: T1204.002 T1047 T1490

TanStack Supply-Chain Attack Execution Indicators - Linux highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

Techniques: T1059.007 T1059.006 T1204.002

AppLocker Prevented Application or Script from Running mediumtest

Author: Pushkarev Dmitry · 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

Suspicious Microsoft Office Child Process hightest

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Techniques: T1047 T1204.002 T1218.010

Flash Player Update from Suspicious Location hightest

Author: Florian Roth (Nextron Systems) · 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997

Detects a flashplayer update from an unofficial location

Techniques: T1189 T1204.002 T1036.005

AppLocker Application Would Have Been Blocked mediumexperimental

Author: heyyanu · 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

New Application in AppCompat informationaltest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 60936b49-fca0-4f32-993d-7415edcf9a5d

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Techniques: T1204.002

Droppers Exploiting CVE-2017-11882 criticalstable

Author: Florian Roth (Nextron Systems) · 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-11882

Suspicious Microsoft Office Child Process - MacOS hightest

Author: Sohan G (D4rkCiph3r) · 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Techniques: T1059.002 T1137.002 T1204.002

All 39 rules on the technique page →

CVE-2021-21017 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1204.002 Malicious File exploitation technique

Sigma rules tagged attack.t1204.002 (39)

Sigma rules tagged `attack.t1204.002` (39)