Sandworm OLE Package — CVE-2014-4114

CVE-2014-4114 is a Windows OLE remote code execution vulnerability exploited by the Russian Sandworm threat group in targeted attacks against NATO and Ukraine in 2014. The attack uses OLE Package objects embedded in PowerPoint (PPSX) files to silently drop and execute .inf and .exe files when the document is opened. The rule requires the OLE Package CLSID plus executable file references (.inf, .exe, .dll, .bat, .cmd, .scr, .vbs, .ps1, or .hta), so it is a strong package-dropper indicator but not a full reconstruction of the original Sandworm exploit chain.