Microsoft · Office
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 13 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
on a well-known Russian cybercrime forum, the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office ([CVE-2017-8570](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-8570)) and another that uses a malicious
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2017-8570 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…on a well-known Russian cybercrime forum, the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office ([CVE-2017-8570](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-8570)) and another that uses a malicious…
Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document.
5 passages name itOriginal (opens in a new tab) ↗
S RIG Exploit Kit VBS PDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570…
4 passages name itOriginal (opens in a new tab) ↗
Figure 9: Screenshot of the Word document containing a PPSX file that exploits CVE-2017-8570…
2 passages name itOriginal (opens in a new tab) ↗
Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.