All Detections

Exploit for CVE-2017-0261

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Sigma