Microsoft patches critical RCE flaws exploited in wild

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Microsoft patches dozens of critical vulnerabilities including two exploited in wild; RCE possible on Windows, Office, Edge, and other products.

Microsoft released critical patches on February 11, 2025, addressing multiple vulnerabilities across a wide range of products. The most severe vulnerabilities enable remote code execution in the context of the logged-on user. Two CVEs—CVE-2025-21391 and CVE-2025-21418—are confirmed exploited in the wild. Affected systems include Windows core components (kernel, DHCP client/server, Kerberos, NTLM, LDAP), Microsoft Office products (Excel, SharePoint, Outlook for Android), Microsoft Edge, Azure Network Watcher, Active Directory Domain Services, Visual Studio, and numerous other Microsoft services and drivers. Successful exploitation could allow attackers to install programs, modify or delete data, or create accounts with full privileges, with impact scaling to the privileges of the compromised user.

Defenders should prioritize patching immediately after testing, particularly for systems running with administrative privileges. The advisory emphasizes applying the principle of least privilege—restricting administrative rights to dedicated accounts and running general users with non-privileged accounts—to reduce exploitation impact. Given confirmed wild exploitation, organizations should treat these patches as urgent and deploy them to Windows and Office infrastructure as a priority.

title: Office Application Spawning Script Interpreter or LOLBin
id: b2c97ae6-e889-5d9f-a2dc-5c565929fb9d
status: experimental
description: Detects Microsoft Office processes (Excel, Word, PowerPoint, Outlook)
  spawning command shells, script hosts or common proxy-execution binaries. This is
  typical post-exploitation behaviour after a successful client-side exploit (e.g.
  a malicious Office document or email) and is rare in normal use. Generalises on
  the parent/child relation, not on any specific CVE or file.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \EXCEL.EXE
    - \WINWORD.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Legacy Office macros or add-ins in business workflows that invoke cmd.exe or PowerShell
- Document management or reporting plugins that launch helper scripts from Office
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-11-2025_2025-016

title: Office Application Spawning WMIC
id: adee3489-0203-56dd-8a25-8c474a2d570e
status: experimental
description: Detects Microsoft Office processes spawning wmic.exe. Attackers use WMI
  (for example 'process call create') to launch payloads out of the Office process
  tree after client-side exploitation. Office has little legitimate reason to start
  wmic.exe.
tags:
- attack.execution
- attack.t1047
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \EXCEL.EXE
    - \WINWORD.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith: \wmic.exe
  condition: selection
falsepositives:
- Inventory or asset-collection macros in Excel that query WMI through wmic.exe
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-11-2025_2025-016

title: IIS Worker Process Spawning Command Shell
id: 1854a651-b3ab-599c-a38d-15b3c60933ff
status: experimental
description: Detects the IIS worker process w3wp.exe (which hosts SharePoint and other
  public-facing web apps) spawning a command shell or script host. This indicates
  likely exploitation of a public-facing application leading to command execution
  in the web server context.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Web applications that intentionally shell out to cmd.exe for administrative tasks
- Deployment or health-check scripts triggered from an IIS-hosted application
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-11-2025_2025-016

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-11-2025_2025-016