We would like to bring your attention to the following 0-day exploit we have recently become aware of.
Follina – A zero-day Microsoft Office code execution vulnerability that bypasses Microsoft Defender for Endpoint. This vulnerability has been seen to be actively exploited in the wild.
Update: Official Patches have been released
Additional mitigation advice has been released by Microsoft. An official patch has now been released and is available in the June 2022 cumulative Windows updates. Alternatively, stand alone versions are accessible from the following URL:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
Description
This exploit uses the Microsoft Word remote template feature to retrieve a HTML file from a remote webserver. The powershell script that is executed utilises ‘msdt.exe’ (Microsoft’s Diagnostic Troubleshooting Wizard – a support tool to aid in troubleshooting), which is executed even if macros are disabled. If the document is saved in RTF format the code will run without even opening the file via the explorer preview tab.
Affected Versions
Office 2013
Office 2016
(There is the potential that later versions are affected, more work is needed before all affected versions are identified.)
Remediation
A Defender for Endpoint query has been written for companies that have the relevant Microsoft package (E5).
DeviceProcessEvents| where ProcessCommandLine contains “msdt.exe”| where InitiatingProcessFileName has_any (@”WINWORD.EXE”, @”EXCEL.EXE”, @”OUTLOOK.EXE”)
At this time there are no specific official patches available, CovertSwarm would advise increased vigilance to be taken in all attached word files into the company.
References:
-
https://medium.com/doublepulsar/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
![Man learning](https://www.covertswarm.com/wp-content/uploads/2024/08/15-640x320.png)
Cybersecurity Glossary
Read this comprehensive list we’ve compiled to assist experts, C-level executives, and those embarking on a cybersecurity career in navigating the extensive array of terms in…
![YOU DESERVE TO BE HACKED @ DEF CON](https://www.covertswarm.com/wp-content/uploads/2024/08/YDTBH-Blog-640x320.png)
CovertSwarm at DEF CON 32: Insights from the Swarm
This time last week, our Swarm was taking over Las Vegas at DEF CON 32 – one of the biggest and oldest hacker conventions in the…
![DEF CON - CovertBrew](https://www.covertswarm.com/wp-content/uploads/2024/08/DEF-CON-CovertBrew-1200-x-600-640x320.png)
How to Own DEF CON Like a Boss
The Swarm have landed in DEF CON, and we have some tips from our experts about surviving, and thriving, at this event.