Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
This vulnerability is well known, affects thousands of enterprise networks, and is trivial to exploit with attack tools. A successful exploit enables an attacker to gain control of a device to install programs, modify data, or create Windows accounts.
Kill Chain
Risk Score
87
A remote code execution vulnerability (RCE) exists in Windows when the Microsoft Support Diagnostic Tool (MSDT) is called by a Microsoft Office application, such as Microsoft Word, through the MSDT URL protocol. To exploit this vulnerability, an attacker tricks the victim into downloading a malicious .docx or .rtf document through techniques such as phishing or social engineering. When the victim opens or previews the document, the Office application automatically sends an HTTP GET request for an HTML file. This HTML file contains a script tag with a malicious command that runs a payload through the MSDT URL protocol on the victim device.
