this is susan bradley for cso online once again we're facing a situation
where office files are being used in targeted attacks against microsoft users this time
the windows explorer preview pane is being used in attacks with malicious doc docs ucm
docs with macros and docx files researchers have also found that malicious rtf files rich
text format can be used in such attacks as well microsoft has released cve 2021-4044
in order to track the vulnerability but once this is fixed i'll urge you to not let your guard down
instead i'll recommend that you evaluate the use of some
mitigation techniques to proactively help yourself in the future from these kinds of zero day attacks
in this particular attack sequence an attacker could craft a malicious
activex control to be used by microsoft office document that hosts the browser rendering engine
the attacker would have to convince you to open the malicious document so of course your
first line of defense is an educated user that doesn't blindly open unexpected files in addition
microsoft defender antivirus and defender for endpoint currently providing detection
and protections for the known vulnerabilities however i have seen some reports that they've only
protected against known hard-coded locations and they're starting to see attacks
go around those measures so again check your antivirus make sure it already includes detections
the other day on twitter will doorman who works for the cert cc who tweets on
his personal account indicated that there's an additional protection that we probably
should be using and in fact i'd recommend that you keep in place all the time and that's using
windows defender or these days microsoft defender asr rules attack surface reduction
rules from spawning child processes in office it's a specific grid code you have to enable and it's
something that we probably should enable now for this zero day and consider leaving on permanently
you go into group policy you go down to administrative templates windows components
and look for microsoft defender antivirus and then on microsoft defender exploit guard
now keep in mind that the name has changed when it first came out it was windows defender
rather than microsoft defender so you'll have to look at that group policy setting
and then you want to look for configure attack service reduction rules and you want to enable
them and then you'll need to click on show and unfortunately the asr rules are not the most
friendly in the world and so you have to look up these grid values but you want a
specific one that means to block office child processes test this setting in your environment
i personally found it had no side effects and it would block these kinds of zero day attacks
now if you want a more specific fix or temporary mitigation i should say there's some registry
entries to set the values for the internet zones so that the activex controls will not
run in the various internet zone policies and you can see the setting there
in addition you can also set the value so that doc do you see x and doc m as well as rtf
do not show in the preview pane in windows explorer now when preview pane is something
that i honestly don't turn on in my computers because i find it slows my computer down
but if you want to proactively disable that setting those are the registry keys to use
and if you want to do all of these settings in one registry value that's easy to do you combine the
the activex zones as well as removing the shell values and the way to remove shell values in a
registry key is merely to put a minus in front of that h key classes root then of course build
yourself a registry key to put these values back in in order to undo this you would sub do a minus
in front of these values up here and put a pot take the minus out below here and again you can
do this as a registry script to push it out to all workstations or do it in intune or also use some
group policies again my recommendation is would be to look into the group policy setting for the um
group policy for the configure attack surface reduction rules
and put that value in and consider leaving it in as a long term solution
so start first by analyzing your risk posture in your firm do you think you'll be potentially
targeted by these zero days do you have users that use the preview pane in windows explorer
do you have users that are click happy do you have users that run with administrative rights
if the answers to all of these questions are yes it's wiser to use this asr rule and keep them in
place even after this zero day is patched until next time this is susan bradley for cso online