Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Public information about this vulnerability can enable an attacker to easily attempt an exploit chain. If an attacker is able to trick users into opening phishing attachments, malicious code can be run on the victim.
Kill Chain
Risk Score
88
The Microsoft Windows operating system (OS) supports a URI protocol handler called search-ms. This protocol handler enables applications and HTML links to launch the Windows Search feature and query for files. The Windows OS has a vulnerability in the way that it processes saved search files with the .search-ms extension. The result is that a downloaded saved search file does not contain a Mark of the Web (MOTW). Without the MOTW, executable code in a downloaded file can run without user interaction.
To exploit this vulnerability, the attacker first sets up a remote Windows share that hosts malicious files. The attacker then creates a phishing email or attachment, such as a Microsoft Word document. If the phishing attempt is successful and the user opens the attachment, an exploit chain of multiple SMB requests is initiated. Each SMB request sent by the client downloads additional malicious files. These downloads can be saved without a MOTW and enable malicious code to run on the victim without user interaction.
