# DOCX template injection via CVE-2017-0199 variant

Published: 2025-07-17 · Severity: elevated
Canonical: https://vorant.io/reports/10bac29a-f2c6-5f02-aa02-180dc6e8714e/docx-template-injection-via-cve-2017-0199-variant

> Malicious DOCX file exploits CVE-2017-0199 to download Word template from attacker-controlled domain.

CISA analyzed a Microsoft Word DOCX file designed to exploit CVE-2017-0199, a known remote template injection vulnerability. The file manipulates the settings.xml.rels file to reference an external template URL (crphone.mireene.com/plugin/editor/Templates/normal.php?name=web) and displays a social-engineering prompt asking users to enable macros—misleading since the document contains no actual macros. When opened in Word, the application attempts to fetch and load the template from the attacker-controlled server. The hosting domain mireene.com is registered and has been used as a command-and-control point. At the time of analysis the external URL was not active, limiting immediate threat assessment. The vulnerability has been known since 2017 and affects Microsoft Word versions that support external template loading without proper validation.

## Mentioned in this report

- Vulnerabilities: CVE-2017-0199 (KEV)
- Malware: CVE-2017-0199 Downloader

## Detection guidance (public sample)

### Office Application Spawning RegSvcs or RegAsm

ATT&CK: T1218.009

Detects Word, Excel or PowerPoint spawning regsvcs.exe or regasm.exe, a proxy-execution pattern used after a malicious document or remote template loads a payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning RegSvcs or RegAsm
id: 0817d258-6cde-5ce4-8c7a-fa645398f2e2
status: experimental
description: Detects Microsoft Office processes spawning regsvcs.exe or regasm.exe.
  These .NET registration utilities are abused for signed-binary proxy execution after
  a weaponised document (for example one using remote template injection) delivers
  a payload. Office has almost no legitimate reason to launch them.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133g
tags:
- attack.stealth
- attack.t1218.009
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \regsvcs.exe
    - \regasm.exe
  condition: selection
falsepositives:
- Rare Office add-in installers or VSTO deployment scripts that register .NET COM
  components
level: high
author: Vorant
```

### Office Process Fetching Remote Template Via Web Request

ATT&CK: T1566.001

Detects Microsoft Office user agents requesting a script or template-type URI from a non-Microsoft host, as seen when a document with an external attachedTemplate relationship loads a remote template (CVE-2017-0199 style). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Process Fetching Remote Template Via Web Request
id: ade6f164-2ee6-56bd-9a0c-3e8bff32d738
status: experimental
description: Detects proxy traffic where the user agent identifies Microsoft Office
  and the request targets a server-side script (.php, .asp, .aspx, .jsp) or a template
  or RTF file on a non-Microsoft host. This is the network footprint of remote template
  injection, where Word fetches an attacker-hosted template referenced from settings.xml.rels.
  Generalises on the Office user agent and URI type, not on a specific domain.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133g
tags:
- attack.initial-access
- attack.t1566.001
- attack.t1566.002
- attack.t1204.002
logsource:
  category: proxy
detection:
  selection_ua:
    c-useragent|contains:
    - Microsoft Office Word
    - Microsoft Office/
    - ms-office
  selection_uri:
    c-uri|contains:
    - .php
    - .asp
    - .jsp
    - .dotm
    - .dot?
    - .rtf
  filter_ms:
    cs-host|endswith:
    - .microsoft.com
    - .office.com
    - .office365.com
    - .live.com
    - .sharepoint.com
    - .officeapps.live.com
  condition: selection_ua and selection_uri and not filter_ms
falsepositives:
- Organisations hosting Office templates on an internal or third-party web portal
  with dynamic (.php/.aspx) endpoints
- Legitimate add-ins that download documents from vendor sites
level: medium
author: Vorant
```

### Office Application Spawning Script Interpreter or LOLBin After Document Open

ATT&CK: T1204.002

Detects Word, Excel or PowerPoint spawning script hosts or common living-off-the-land binaries, typical of post-exploitation after a weaponised document loads remote content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin After Document Open
id: 5cc8b2e9-d4ab-5067-8b49-e9d1515e6328
status: experimental
description: Detects Microsoft Office processes spawning mshta, wscript, cscript,
  regsvr32, rundll32, powershell, cmd or bitsadmin. After a remote template injection
  exploit such as CVE-2017-0199 succeeds, Word commonly launches these to stage a
  payload. The social-engineering prompt asking users to enable macros leads to the
  same child-process pattern.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133g
tags:
- attack.execution
- attack.t1204.002
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legitimate macro-enabled business workbooks or documents that shell out to cmd or
  PowerShell
- Office add-ins that invoke rundll32 for printer or shell functions
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133g

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/10bac29a-f2c6-5f02-aa02-180dc6e8714e/docx-template-injection-via-cve-2017-0199-variant.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup