Windows Search Exploit - CVE-2023-36884

The Microsoft Windows operating system (OS) supports a URI protocol handler called search-ms. This protocol handler enables applications and HTML links to launch the Windows Search feature and query for files. The Windows OS has a vulnerability in the way that it processes saved search files with the .search-ms extension. The result is that a downloaded saved search file does not contain a Mark of the Web (MOTW). Without the MOTW, executable code in a downloaded file can run without user interaction.
To exploit this vulnerability, the attacker first sets up a remote Windows share that hosts malicious files. The attacker then creates a phishing email or attachment, such as a Microsoft Word document. If the phishing attempt is successful and the user opens the attachment, an exploit chain of multiple SMB requests is initiated. Each SMB request sent by the client downloads additional malicious files. These downloads can be saved without a MOTW and enable malicious code to run on the victim without user interaction.