Zero Days - Follina

I recently learned of actively exploited zero-days that seem high risk.

The zero-days bypass AntiVirus (AV) and User Access Control (UAC) protections by exploiting Windows built-in MSProtocol URI scheme.

Microsoft has yet to release patches, and the ease with which these exploits bypass known protections is alarming.

The scope of the attack surface is still being discovered as cybersecurity researchers attempt to test various schemas within the MSProtocol URI.

Users will have to manually modify the registry, backup, and delete entries to mitigate risks.

The following links highlight the issues more in-depth:

https://medium.com/doublepulsar/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack

A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.

Huntress-1John Hammond