McAfee Defender’s Blog: NetWalker
Network Security Platform (CVE-2015-1701); Endpoint Security Platform 10.7, Threat Prevention, Application Control (MAC)
2 passages name itOriginal (opens in a new tab) ↗
CVE-2015-1701 KEVRansomwarePublic exploit High · 7.8 EPSS 55.9%
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k
Summary
A flaw in Win32k.sys, the kernel-mode driver component of Microsoft Win32k, affects Microsoft Windows Server 2003 SP2, Vista SP2 and Server 2008 SP2. An attacker with local, low-privilege access to the system can run a crafted application to gain elevated privileges, without requiring user interaction.
Official description · NVD
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
86.0 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 3
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 days before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 21 days after disclosure.
- First seen exploitedVulnCheck KEV evidence3 days before
- Disclosedday 0
- Public exploit codePoC-in-GitHub+21 days
- Added to CISA KEVknown ransomware use; EU database agrees+7 yrs
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 3 cited passages 1Privilege EscalationTA0004
Exploitation for Privilege Escalation T1068 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the CVE · uncategorised
Exploitation for Privilege Escalation (T1068): CVE-2020-0796, CVE-2019-1458, CVE-2017-0213, CVE-2015-1701
Exploitation for Privilege Exploitation ((T1068) CVE-2015-1701
Detection
0 rules for this CVE · 31 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2015-1701 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploitation for Privilege EscalationT106831 general rules
- Exploiting CVE-2019-1388criticalstable
- Audit CVE Eventcriticaltest
- HackTool - SysmonEOP Executioncriticaltest
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
- Possible Coin Miner CPU Priority Paramcriticaltest
- Potential CVE-2021-41379 Exploitation Attemptcriticaltest
- Potential SystemNightmare Exploitation Attemptcriticaltest
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 3 threat reports3 reportsmcafee.com2Microsoft
Reports are matched by finding the exact id CVE-2015-1701 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Microsoft Security
STRONTIUM's CVE-2015-1701 exploit terminates execution on the newest versions of Windows…
5 passages name itOriginal (opens in a new tab) ↗
Take a “NetWalk” on the Wild Side
Mentions the CVE; no further detail.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX