Microsoft · Windows
The flaw is an out-of-bounds write in the Windows VBScript Engine, a component of Microsoft Windows, in the way the engine handles objects in memory. An attacker can achieve remote code execution by exploiting this flaw over the network, with no authentication required, but the attack is hard to carry out and requires a user to take an action such as opening a crafted file or visiting a malicious page.
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
First seen exploited 1 day before it was disclosed. Public exploit code (Exploit-DB) appeared 12 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Successful exploitation yields arbitrary code execution
remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2018-8174 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
…k 3k 2k 1k 0 Social Engineering Office VBA Macro Thread Hijacking PowerShell WMI Keitaro TDS RIG Exploit Kit PDF XL4 Macro VBS Password Protected Regsvr32 Compressed Executable Geofencing Regsvcs/Regasm Scheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.