topic Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies? in Endpoint Security

Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

00urb57x9u0O6CPE25d6 — Thu, 09 Sep 2021 12:47:05 GMT

In a new advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444), Microsoft mentions (normal, their product) that Microsoft Defender... provide detection and protections for the known vulnerability. Also... alerts will be displayed as: “Suspicious Cpl File Execution”.

What is Cisco's behaviour in regards to this one?

Tks.

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

DaphneG — Thu, 09 Sep 2021 16:23:09 GMT

Our Research and Efficacy team is currently investigating this vulnerability. We'll share the findings as soon as it's available.

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

DaphneG — Thu, 09 Sep 2021 19:48:06 GMT

We have signature-based coverage since yesterday. Our team is working on adding more coverage through Behavioral Protection engine and Cloud IOCs.

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

DaphneG — Thu, 09 Sep 2021 20:10:06 GMT

I meant to include earlier that for those interested Cisco Talos also released new SNORT rules for this CVE: https://blog.talosintelligence.com/2021/09/talos-release-protection-against-zero.html#more

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

ITGuyCSI25 — Fri, 10 Sep 2021 03:25:19 GMT

Talos mentions deploying "ClamAV signature Doc.Exploit.CVE_2012_40444-9891528-0" is this something we as AMP administrators need to do or is this already done for us?

Otherwise, it would be great if Cisco would provide some Custom Detections - Advanced Signature sets we could use in the meantime.

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

Ken Stieers — Fri, 10 Sep 2021 03:47:06 GMT

This article mentions some IOCs:
https://www.bleepingcomputer.com/news/microsoft/windows-mshtml-zero-day-defenses-bypassed-as-new-info-emerges/

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

mnarayandas — Fri, 10 Sep 2021 23:04:44 GMT

Is there anything to be done on Cisco AMP side? Does this vulnerability covered under Tetra signatures of Cisco AMP?

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

reubooke — Mon, 13 Sep 2021 15:24:49 GMT

Also would like information regarding what needs to be done on the Cisco AMP side

Re: Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

DaphneG — Mon, 13 Sep 2021 17:44:51 GMT

Sorry for the delay in the response. AMP has released the following Cloud IOCs and Behavioral Protection (BP) signature since Thursday afternoon:

W32.WinwordLaunchedControl.ioc (Cloud IOC)
W32.SuspiciousControl_RunDLLExecution.ioc (Cloud IOC)
Suspicious Control Process Pattern (BP signature)

The details of each can be found in the Indicators page: https://console.amp.cisco.com/indicators

You might want to monitor and investigate the endpoints that triggered these events.