"MSHTML vulnerability CVE-2021-40444 attack"

[carel-v98]

Not 100% sure of my tasks, please review.

[DGOV-Bryce]

In looking over the link in the Analytics Rule (https://www.microsoft.com/en-us/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/):

• there is a Mitigating the Attacks section that could either be added as a link as it gives good advice to go through, like Blocking all Office apps from creating child processes, etc. Though that is mitigation less so triage.
• You could add scanning to the remediation section.
• There is threat hunting KQL (at the bottom) in the link they could use to check for other instances throughout their infra.

[carel-v98]

Added link to remedation as well as scanning recommendation