McAfee Defender’s Blog: NetWalker
Network Security Platform (CVE-2017-0213); Endpoint Security Platform 10.7 (CVE-2017-0213) Threat Prevention, Application Control (MAC)
2 passages name itOriginal (opens in a new tab) ↗
CVE-2017-0213 KEVRansomwarePublic exploit High · 7.3 EPSS 84.3%
Microsoft Windows Privilege Escalation Vulnerability
Microsoft · Windows
Summary
The Windows COM Aggregate Marshaler component in Microsoft Windows (including Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, Windows 10 and Windows Server 2012 and 2016) contains a privilege escalation flaw that allows an elevation of privilege. An attacker who already has local access and low-privilege authentication can exploit it by running a specially crafted application, which requires user interaction.
Official description · NVD
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
87.0 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 4
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 19 months after disclosure. Public exploit code (Exploit-DB) appeared 5 days after disclosure.
- Disclosedday 0
- Public exploit codeExploit-DB+5 days
- First seen exploitedVulnCheck KEV evidence+19 mo
- Added to CISA KEVknown ransomware use; EU database agrees+5 yrs
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 4 cited passages 11Privilege EscalationTA0004
Exploitation for Privilege Escalation T1068 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the CVE · uncategorised
Exploitation for Privilege Escalation (T1068): CVE-2020-0796, CVE-2019-1458, CVE-2017-0213, CVE-2015-1701
Exploitation for Privilege Exploitation ((T1068) CVE-2017-0213
Abuse Elevation Control Mechanism T1548 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · primary impact
elevates privileges beyond intended level
allows an elevation privilege vulnerability when an attacker runs a specially crafted application
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploitation for StealthT1211 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
Detection
0 rules for this CVE · 55 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2017-0213 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Abuse Elevation Control MechanismT154824 general rules
- Abused Debug Privilege by Arbitrary Parent Processeshightest
- COM Hijack via Sdclthightest
- Credential Dumping Attempt Via Svchosthightest
- Potential Privilege Escalation via Local Kerberos Relay over LDAPhightest
- Regedit as Trusted Installerhightest
- Vulnerable Netlogon Secure Channel Connection Allowedhightest
- Registry Hive File Staged Outside Standard User Profile Pathhighexperimental
- Linux Doas Conf File Creationmediumstable
Exploitation for Privilege EscalationT106831 general rules
- Exploiting CVE-2019-1388criticalstable
- Audit CVE Eventcriticaltest
- HackTool - SysmonEOP Executioncriticaltest
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
- Possible Coin Miner CPU Priority Paramcriticaltest
- Potential CVE-2021-41379 Exploitation Attemptcriticaltest
- Potential SystemNightmare Exploitation Attemptcriticaltest
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 4 threat reports4 reportsmcafee.com2Google MandiantTrend Micro
Reports are matched by finding the exact id CVE-2017-0213 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
OVERRULED: Containing a Potentially Destructive Adversary
The actor leveraged a publicly available exploit for CVE-2017-0213 to escalate privileges, publicly available Windows SysInternals PROCDUMP to dump the LSASS process, and publicly available MIMIKATZ to presumably steal additional credentials.
Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations
…a clipboard stealer, wherein the content is encrypted with the same algorithm as the type 1 backdoor; a network traffic tunnel named EarthWorm;13 a public IP address retriever; 14 an NBTScan tool for enumerating NetBIOS shares; a brute-force tool; 15 and an elevation of privilege tool for exploiting CVE-2017-0213.
2 passages name itOriginal (opens in a new tab) ↗
Take a “NetWalk” on the Wild Side
Mentions the CVE; no further detail.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX