Microsoft · Office
A memory-handling flaw in Microsoft Office's shared components, affecting Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016, lets an attacker execute arbitrary commands. Exploitation requires local access to the system, no prior privileges, and a user to interact with a crafted object or file.
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
First seen exploited 14 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 22 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
arbitrary command execution on victim
allow an attacker to execute arbitrary commands
user opens malicious file or message
allow an attacker to execute arbitrary commands
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2017-11774 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Office 365 accounts and not blocked by MFA defense, the group launched the next step with Ruler and configured a malicious Home Page URL which, once rendered during a normal email session, resulted in the remote code execution of a PowerShell backdoor through the exploitation of a vulnerability like CVE-2017-11774.
2 passages name itOriginal (opens in a new tab) ↗
The actor leveraged stolen credentials and RULER’s module that exploits CVE-2017-11774 (RULER.HOMEPAGE), modifying numerous users’ Outlook client homepages for code execution and persistence.
5 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.