From f7c411cfa2e2daa236b1bbfbe0425ba910fc9485 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Sun, 1 Oct 2023 11:24:18 -0700 Subject: [PATCH] Update windows_theme_command_execution.yml --- detections/endpoint/windows_theme_command_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_theme_command_execution.yml b/detections/endpoint/windows_theme_command_execution.yml index 663ecd7964..0a48491e51 100644 --- a/detections/endpoint/windows_theme_command_execution.yml +++ b/detections/endpoint/windows_theme_command_execution.yml @@ -7,7 +7,7 @@ status: experimental type: TTP description: 'The vulnerability, referred to as "ThemeBleed", is a high-severity issue with a score of 8.8. It allows remote attackers to execute code if the target user opens a malicious .THEME file crafted by the attacker. The exploit takes advantage of a race condition when handling .MSSTYLES files. Specifically, when a version number "999" is used, there's a discrepancy between the time a DLL’s (“_vrf.dll”) signature is verified and when the library loads. -This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.'' +This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.' data_source: - Sysmon search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)