From b8255432f0e4569f49b01bbca536b54d85111fae Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Jul 2023 13:36:31 -0600 Subject: [PATCH 1/3] CVE-2023-36884 coverage CVE-2023-36884 --- .../mshtml_module_load_in_office_product.yml | 7 +++-- .../office_product_spawn_cmd_process.yml | 7 +++-- .../office_product_spawning_bitsadmin.yml | 7 +++-- .../office_product_spawning_certutil.yml | 7 +++-- .../office_product_spawning_mshta.yml | 7 +++-- ..._product_spawning_rundll32_with_no_dll.yml | 7 +++-- ...e_product_spawning_windows_script_host.yml | 7 +++-- .../endpoint/office_product_spawning_wmic.yml | 7 +++-- ...ice_and_windows_html_rce_vulnerability.yml | 31 +++++++++++++++++++ 9 files changed, 63 insertions(+), 24 deletions(-) create mode 100644 stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 87ce0f8aed..be6676c743 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -1,7 +1,7 @@ name: MSHTML Module Load in Office Product id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 5 -date: '2023-02-15' +version: 6 +date: '2023-07-11' author: Michael Haag, Mauricio Velazco, Splunk status: production type: TTP @@ -13,7 +13,7 @@ description: The following detection identifies the module load of mshtml.dll in data_source: - Sysmon Event ID 7 search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") + "msaccess.exe","Graph.exe","winproj.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' @@ -30,6 +30,7 @@ tags: analytic_story: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 100 cve: diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index d3e2a20289..e12e26db54 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -1,7 +1,7 @@ name: Office Product Spawn CMD Process id: b8b19420-e892-11eb-9244-acde48001122 -version: 4 -date: '2022-02-15' +version: 5 +date: '2023-07-11' author: Teoderick Contreras, Splunk status: production type: TTP @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe" OR Processes.parent_process_name = "onenotem.exe" OR Processes.parent_process_name = "onenoteviewer.exe" OR Processes.parent_process_name - = "onenoteim.exe" OR Processes.parent_process_name = "msaccess.exe") `process_cmd` + = "onenoteim.exe" OR Processes.parent_process_name = "msaccess.exe" OR Processes.parent_process_name="Graph.exe" OR Processes.parent_process_name="winproj.exe") `process_cmd` by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -43,6 +43,7 @@ tags: - Qakbot - AgentTesla - CVE-2023-21716 Word RTF Heap Corruption + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index b1b6519709..0b977bd22b 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -1,7 +1,7 @@ name: Office Product Spawning BITSAdmin id: e8c591f4-a6d7-11eb-8cf7-acde48001122 -version: 4 -date: '2023-02-15' +version: 5 +date: '2023-07-11' author: Michael Haag, Splunk status: production type: TTP @@ -21,7 +21,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe") `process_bitsadmin` by Processes.dest Processes.user Processes.parent_process + "msaccess.exe", "Graph.exe","winproj.exe") `process_bitsadmin` by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`' @@ -37,6 +37,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 0d28777b88..b6fc5315d1 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -1,7 +1,7 @@ name: Office Product Spawning CertUtil id: 6925fe72-a6d5-11eb-9e17-acde48001122 -version: 4 -date: '2023-02-15' +version: 5 +date: '2023-07-11' author: Michael Haag, Splunk status: production type: TTP @@ -19,7 +19,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe") `process_certutil` by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` @@ -39,6 +39,7 @@ tags: - Spearphishing Attachments - AgentTesla - Trickbot + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index b16f99b59b..0f79a5eb32 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -1,7 +1,7 @@ name: Office Product Spawning MSHTA id: 6078fa20-a6d2-11eb-b662-acde48001122 -version: 3 -date: '2023-02-15' +version: 4 +date: '2023-07-11' author: Michael Haag, Splunk status: production type: TTP @@ -20,7 +20,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe", "onenote.exe","onenotem.exe", - "msaccess.exe") `process_mshta` by Processes.dest Processes.user Processes.parent_process + "msaccess.exe","Graph.exe","winproj.exe") `process_mshta` by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`' @@ -37,6 +37,7 @@ tags: - Spearphishing Attachments - IcedID - Azorult + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 6f5044448b..056f520079 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -1,7 +1,7 @@ name: Office Product Spawning Rundll32 with no DLL id: c661f6be-a38c-11eb-be57-acde48001122 -version: 4 -date: '2023-02-15' +version: 5 +date: '2023-07-11' author: Michael Haag, Splunk status: production type: TTP @@ -20,7 +20,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest + "msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_rundll32_with_no_dll_filter`' @@ -38,6 +38,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 60d265db4f..1ee9202a91 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -1,7 +1,7 @@ name: Office Product Spawning Windows Script Host id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 -version: 3 -date: '2023-02-15' +version: 4 +date: '2023-07-11' author: Michael Haag, Splunk status: production type: TTP @@ -13,7 +13,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe") Processes.process_name IN ("wscript.exe", "cscript.exe") by Processes.dest + "msaccess.exe","Graph.exe","winproj.exe") Processes.process_name IN ("wscript.exe", "cscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_windows_script_host_filter`' @@ -32,6 +32,7 @@ tags: analytic_story: - Spearphishing Attachments - Remcos + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index e3abcd5c37..a1c614e7e6 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -1,7 +1,7 @@ name: Office Product Spawning Wmic id: ffc236d6-a6c9-11eb-95f1-acde48001122 -version: 5 -date: '2023-02-15' +version: 6 +date: '2023-07-11' author: Michael Haag, Splunk status: production type: TTP @@ -19,7 +19,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe") `process_wmic` by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` @@ -39,6 +39,7 @@ tags: analytic_story: - Spearphishing Attachments - FIN7 + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml b/stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml new file mode 100644 index 0000000000..93c8fd39df --- /dev/null +++ b/stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml @@ -0,0 +1,31 @@ +name: CVE-2023-36884 - Office and Windows HTML RCE Vulnerability +id: dd7fb691-63d6-47ad-9a7f-1b9005cefad2 +version: 1 +date: '2023-07-11' +author: Michael Haag, Splunk +description: CVE-2023-36884 is an unpatched zero-day vulnerability affecting Windows and Microsoft Office products. The vulnerability allows for remote code execution through specially crafted Microsoft Office documents, enabling an attacker to operate in the context of the victim. As of now, there are no security updates available. However, users of Microsoft Defender for Office and the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are safeguarded against this exploit. For other users, temporary mitigation can be achieved by adding specific application names to a designated registry key. +narrative: CVE-2023-36884 is a serious security vulnerability that affects a range of Microsoft Office products and Windows systems. It is a zero-day flaw, meaning it was already being exploited before Microsoft became aware of it or had a chance to develop a patch. \ + + An attacker exploiting this vulnerability would create a Microsoft Office document containing malicious code. This document, when opened by the victim, allows for remote code execution, giving the attacker the ability to run their own code on the victim's machine. This poses a significant risk as the attacker could perform actions like data theft, system damage, or creating backdoors for future access. \ + + Currently, there is no security patch available from Microsoft, which makes the issue more critical. Microsoft is working on investigating these vulnerabilities and will likely provide a security update either through their monthly release cycle or an out-of-cycle update, based on the urgency. \ + + In the meantime, users of Microsoft Defender for Office and those utilizing the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are protected from attempts to exploit this vulnerability. This is because these protections add an extra layer of security, blocking the malicious code from executing. \ + + For users who are not using these protections, Microsoft recommends a workaround by adding specific application names to a particular Windows registry key (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION) with data set as "1". This action aims to mitigate the risk until a permanent fix is available. \ + + The disclosure of this flaw involved multiple entities including Microsoft Threat Intelligence, Vlad Stolyarov, Clement Lecigne and Bahare Sabouri from Google's Threat Analysis Group (TAG), Paul Rascagneres and Tom Lancaster from Volexity, and the Microsoft Office Product Group Security Team. This collective effort indicates the severity and importance of addressing this issue. +references: + - https://gist.github.com/MHaggis/22ad19081300493e70ce0b873e98b2d0 + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 + - https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2023-patch-tuesday-warns-of-6-zero-days-132-flaws/ + - https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/ +tags: + analytic_story: CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 0c7afb468197d1d20333fe06ecafac8cca6d49cf Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Jul 2023 13:40:04 -0600 Subject: [PATCH 2/3] Update office_document_spawned_child_process_to_download.yml --- .../office_document_spawned_child_process_to_download.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index a57f9f3985..f61a2404ec 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -1,7 +1,7 @@ name: Office Document Spawned Child Process To Download id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 5 -date: '2023-02-15' +version: 6 +date: '2023-07-11' author: Teoderick Contreras, Splunk status: production type: TTP @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id @@ -31,6 +31,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 50 impact: 70 From e27fcf29c3f78b910448ae72f58a33787031a889 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Jul 2023 13:51:42 -0600 Subject: [PATCH 3/3] remove hyphen remove - --- detections/endpoint/mshtml_module_load_in_office_product.yml | 2 +- .../office_document_spawned_child_process_to_download.yml | 2 +- detections/endpoint/office_product_spawn_cmd_process.yml | 2 +- detections/endpoint/office_product_spawning_bitsadmin.yml | 2 +- detections/endpoint/office_product_spawning_certutil.yml | 2 +- detections/endpoint/office_product_spawning_mshta.yml | 2 +- .../endpoint/office_product_spawning_rundll32_with_no_dll.yml | 2 +- .../endpoint/office_product_spawning_windows_script_host.yml | 2 +- detections/endpoint/office_product_spawning_wmic.yml | 2 +- ..._2023_36884_office_and_windows_html_rce_vulnerability.yml} | 4 ++-- 10 files changed, 11 insertions(+), 11 deletions(-) rename stories/{cve_2023_36884___office_and_windows_html_rce_vulnerability.yml => cve_2023_36884_office_and_windows_html_rce_vulnerability.yml} (95%) diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index be6676c743..d2cfe95ce0 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -30,7 +30,7 @@ tags: analytic_story: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 100 cve: diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index f61a2404ec..f026ef5d30 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -31,7 +31,7 @@ references: tags: analytic_story: - Spearphishing Attachments - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index e12e26db54..9e4f45b0fa 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -43,7 +43,7 @@ tags: - Qakbot - AgentTesla - CVE-2023-21716 Word RTF Heap Corruption - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 0b977bd22b..4d7563ff48 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -37,7 +37,7 @@ references: tags: analytic_story: - Spearphishing Attachments - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index b6fc5315d1..55f13dc9ed 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -39,7 +39,7 @@ tags: - Spearphishing Attachments - AgentTesla - Trickbot - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 0f79a5eb32..73deb19398 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -37,7 +37,7 @@ tags: - Spearphishing Attachments - IcedID - Azorult - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 056f520079..a0f1fb6803 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -38,7 +38,7 @@ references: tags: analytic_story: - Spearphishing Attachments - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 1ee9202a91..29c521a044 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -32,7 +32,7 @@ tags: analytic_story: - Spearphishing Attachments - Remcos - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index a1c614e7e6..b878783aba 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -39,7 +39,7 @@ tags: analytic_story: - Spearphishing Attachments - FIN7 - - CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint confidence: 90 impact: 70 diff --git a/stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml b/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml similarity index 95% rename from stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml rename to stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml index 93c8fd39df..00cfc40f1e 100644 --- a/stories/cve_2023_36884___office_and_windows_html_rce_vulnerability.yml +++ b/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml @@ -1,4 +1,4 @@ -name: CVE-2023-36884 - Office and Windows HTML RCE Vulnerability +name: CVE-2023-36884 Office and Windows HTML RCE Vulnerability id: dd7fb691-63d6-47ad-9a7f-1b9005cefad2 version: 1 date: '2023-07-11' @@ -21,7 +21,7 @@ references: - https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2023-patch-tuesday-warns-of-6-zero-days-132-flaws/ - https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/ tags: - analytic_story: CVE-2023-36884 - Office and Windows HTML RCE Vulnerability + analytic_story: CVE-2023-36884 Office and Windows HTML RCE Vulnerability category: - Adversary Tactics product: