Microsoft MSHTML RCE - CVE-2021-40444 : how Cisco replies?

[00urb57x9u0O6CPE25d6]

In a new advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444), Microsoft mentions (normal, their product) that Microsoft Defender... provide detection and protections for the known vulnerability. Also... alerts will be displayed as: “Suspicious Cpl File Execution”.

What is Cisco's behaviour in regards to this one?

Tks.

[DaphneG]

Our Research and Efficacy team is currently investigating this vulnerability. We'll share the findings as soon as it's available. 

[DaphneG]

We have signature-based coverage since yesterday. Our team is working on adding more coverage through Behavioral Protection engine and Cloud IOCs.

[DaphneG]

I meant to include earlier that for those interested Cisco Talos also released new SNORT rules for this CVE: https://blog.talosintelligence.com/2021/09/talos-release-protection-against-zero.html#more

[ITGuyCSI25]

Talos mentions deploying "ClamAV signature Doc.Exploit.CVE_2012_40444-9891528-0" is this something we as AMP administrators need to do or is this already done for us? 

Otherwise, it would be great if Cisco would provide some Custom Detections - Advanced Signature sets we could use in the meantime.

[Ken Stieers]

This article mentions some IOCs:
https://www.bleepingcomputer.com/news/microsoft/windows-mshtml-zero-day-defenses-bypassed-as-new-info-emerges/

[mnarayandas]

Is there anything to be done on Cisco AMP side?  Does this vulnerability covered under Tetra signatures of Cisco AMP?

[reubooke]

Also would like information regarding what needs to be done on the Cisco AMP side 

[DaphneG]

Sorry for the delay in the response. AMP has released the following Cloud IOCs and Behavioral Protection (BP) signature since Thursday afternoon:

W32.WinwordLaunchedControl.ioc (Cloud IOC)
W32.SuspiciousControl_RunDLLExecution.ioc (Cloud IOC)
Suspicious Control Process Pattern (BP signature)

The details of each can be found in the Indicators page: https://console.amp.cisco.com/indicators

You might want to monitor and investigate the endpoints that triggered these events.