Microsoft Patches Actively Exploited Mark of the Web Flaw
Microsoft's December 2022 Patch Tuesday fixes CVE-2022-44698, a SmartScreen/Mark of the Web bypass already exploited in the wild.
IPA (Japan's Information-technology Promotion Agency) issued an alert on December 14, 2022 regarding Microsoft's monthly security update, which addresses multiple vulnerabilities across Microsoft products. Exploitation of these flaws could allow applications to crash or give attackers control over affected systems.
Of particular concern is CVE-2022-44698, which Microsoft has confirmed is being actively exploited in the wild. This flaw relates to a Mark of the Web (MotW) security feature bypass, allowing attackers to craft malicious files that evade SmartScreen and other security warnings normally triggered for internet-downloaded files. IPA urges users and organizations to apply Microsoft's patches immediately given the risk of expanding exploitation.
No specific threat actors, malware families, or IOCs were disclosed in this advisory; it serves as a general call to action for prompt patch deployment via Windows Update.
Mentioned in this report
Detection guidance
Process Execution From Mounted Disk Image Volume (Potential MotW Bypass)
Detects processes executed from a drive letter path typical of a newly mounted ISO/IMG/VHD container, a common technique to smuggle payloads that bypass Mark-of-the-Web propagation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution From Mounted Disk Image Volume
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \explorer.exe
CommandLine|re: ^[A-Za-z]:\\.*\.(exe|dll|scr|js|vbs|lnk|hta|msi)
mount_indicators:
CommandLine|contains:
- :\\
filter:
CommandLine|contains:
- C:\\Windows\\
- C:\\Program Files
- C:\\Program Files (x86)
condition: selection and mount_indicators and not filter
falsepositives:
- Legitimate software installers or portable applications distributed via ISO/IMG
images mounted by users
- IT-provided virtual media (VHD/VHDX) used for deployment tooling
level: medium
tags:
- attack.t1553.005
- attack.defense_evasion
id: a6427f27-4db8-5feb-9f7f-1b0778d18294
status: experimental
author: Vorant
Suspicious Script or Executable Launched From Archive Extraction Path Without Preceding Download Prompt
Detects execution of scripting engines or LNK/HTA files from user-writable extraction paths (e.g., temp, downloads) shortly after archive handling, consistent with MotW bypass techniques that allow contained payloads to run without SmartScreen warnings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Execution From Extracted Archive Path
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
CommandLine|contains:
- \\Temp\\
- \\Downloads\\
- \\AppData\\Local\\Temp\\
parent_filter:
ParentImage|endswith:
- \explorer.exe
filter:
CommandLine|contains:
- Program Files
condition: selection and parent_filter and not filter
falsepositives:
- Legitimate scripts run by users directly from download or temp folders for administrative
tasks
- Software update or installer scripts staged in temp directories
level: low
tags:
- attack.t1553.005
- attack.defense_evasion
id: f5021866-08d3-5f19-8dbc-588bd43865fc
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/1214-ms.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free