DOCX template injection via CVE-2017-0199 variant
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Malicious DOCX file exploits CVE-2017-0199 to download Word template from attacker-controlled domain.
CISA analyzed a Microsoft Word DOCX file designed to exploit CVE-2017-0199, a known remote template injection vulnerability. The file manipulates the settings.xml.rels file to reference an external template URL (crphone.mireene.com/plugin/editor/Templates/normal.php?name=web) and displays a social-engineering prompt asking users to enable macros—misleading since the document contains no actual macros. When opened in Word, the application attempts to fetch and load the template from the attacker-controlled server. The hosting domain mireene.com is registered and has been used as a command-and-control point. At the time of analysis the external URL was not active, limiting immediate threat assessment. The vulnerability has been known since 2017 and affects Microsoft Word versions that support external template loading without proper validation.
Mentioned in this report
Detection guidance
Office Application Spawning RegSvcs or RegAsm
Detects Word, Excel or PowerPoint spawning regsvcs.exe or regasm.exe, a proxy-execution pattern used after a malicious document or remote template loads a payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning RegSvcs or RegAsm
id: 0817d258-6cde-5ce4-8c7a-fa645398f2e2
status: experimental
description: Detects Microsoft Office processes spawning regsvcs.exe or regasm.exe.
These .NET registration utilities are abused for signed-binary proxy execution after
a weaponised document (for example one using remote template injection) delivers
a payload. Office has almost no legitimate reason to launch them.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133g
tags:
- attack.stealth
- attack.t1218.009
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith:
- \regsvcs.exe
- \regasm.exe
condition: selection
falsepositives:
- Rare Office add-in installers or VSTO deployment scripts that register .NET COM
components
level: high
author: Vorant
Office Process Fetching Remote Template Via Web Request
Detects Microsoft Office user agents requesting a script or template-type URI from a non-Microsoft host, as seen when a document with an external attachedTemplate relationship loads a remote template (CVE-2017-0199 style). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Process Fetching Remote Template Via Web Request
id: ade6f164-2ee6-56bd-9a0c-3e8bff32d738
status: experimental
description: Detects proxy traffic where the user agent identifies Microsoft Office
and the request targets a server-side script (.php, .asp, .aspx, .jsp) or a template
or RTF file on a non-Microsoft host. This is the network footprint of remote template
injection, where Word fetches an attacker-hosted template referenced from settings.xml.rels.
Generalises on the Office user agent and URI type, not on a specific domain.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133g
tags:
- attack.initial-access
- attack.t1566.001
- attack.t1566.002
- attack.t1204.002
logsource:
category: proxy
detection:
selection_ua:
c-useragent|contains:
- Microsoft Office Word
- Microsoft Office/
- ms-office
selection_uri:
c-uri|contains:
- .php
- .asp
- .jsp
- .dotm
- .dot?
- .rtf
filter_ms:
cs-host|endswith:
- .microsoft.com
- .office.com
- .office365.com
- .live.com
- .sharepoint.com
- .officeapps.live.com
condition: selection_ua and selection_uri and not filter_ms
falsepositives:
- Organisations hosting Office templates on an internal or third-party web portal
with dynamic (.php/.aspx) endpoints
- Legitimate add-ins that download documents from vendor sites
level: medium
author: Vorant
Office Application Spawning Script Interpreter or LOLBin After Document Open
Detects Word, Excel or PowerPoint spawning script hosts or common living-off-the-land binaries, typical of post-exploitation after a weaponised document loads remote content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter or LOLBin After Document Open
id: 5cc8b2e9-d4ab-5067-8b49-e9d1515e6328
status: experimental
description: Detects Microsoft Office processes spawning mshta, wscript, cscript,
regsvr32, rundll32, powershell, cmd or bitsadmin. After a remote template injection
exploit such as CVE-2017-0199 succeeds, Word commonly launches these to stage a
payload. The social-engineering prompt asking users to enable macros leads to the
same child-process pattern.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133g
tags:
- attack.execution
- attack.t1204.002
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith:
- \mshta.exe
- \wscript.exe
- \cscript.exe
- \regsvr32.exe
- \rundll32.exe
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Legitimate macro-enabled business workbooks or documents that shell out to cmd or
PowerShell
- Office add-ins that invoke rundll32 for printer or shell functions
level: medium
author: Vorant
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133g
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs