Microsoft Patches Actively Exploited Mark of the Web Flaw
Microsoft's December 2022 Patch Tuesday fixes CVE-2022-44698, a SmartScreen/Mark of the Web bypass already exploited in the wild.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2022-44698 as exploited in the wild.
IPA (Japan's Information-technology Promotion Agency) issued an alert on December 14, 2022 regarding Microsoft's monthly security update, which addresses multiple vulnerabilities across Microsoft products. Exploitation of these flaws could allow applications to crash or give attackers control over affected systems.
Of particular concern is CVE-2022-44698, which Microsoft has confirmed is being actively exploited in the wild. This flaw relates to a Mark of the Web (MotW) security feature bypass, allowing attackers to craft malicious files that evade SmartScreen and other security warnings normally triggered for internet-downloaded files. IPA urges users and organizations to apply Microsoft's patches immediately given the risk of expanding exploitation.
No specific threat actors, malware families, or IOCs were disclosed in this advisory; it serves as a general call to action for prompt patch deployment via Windows Update.
Mentioned in this report
Detection guidance
Process Execution From Mounted Disk Image Volume (Potential MotW Bypass)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects processes executed from a drive letter path typical of a newly mounted ISO/IMG/VHD container, a common technique to smuggle payloads that bypass Mark-of-the-Web propagation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution From Mounted Disk Image Volume
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \explorer.exe
CommandLine|re: ^[A-Za-z]:\\.*\.(exe|dll|scr|js|vbs|lnk|hta|msi)
mount_indicators:
CommandLine|contains:
- :\\
filter:
CommandLine|contains:
- C:\\Windows\\
- C:\\Program Files
- C:\\Program Files (x86)
condition: selection and mount_indicators and not filter
falsepositives:
- Legitimate software installers or portable applications distributed via ISO/IMG
images mounted by users
- IT-provided virtual media (VHD/VHDX) used for deployment tooling
level: medium
tags:
- attack.t1553.005
- attack.defense-impairment
id: a6427f27-4db8-5feb-9f7f-1b0778d18294
status: experimental
author: Vorant
Suspicious Script or Executable Launched From Archive Extraction Path Without Preceding Download Prompt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of scripting engines or LNK/HTA files from user-writable extraction paths (e.g., temp, downloads) shortly after archive handling, consistent with MotW bypass techniques that allow contained payloads to run without SmartScreen warnings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Execution From Extracted Archive Path
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
CommandLine|contains:
- \\Temp\\
- \\Downloads\\
- \\AppData\\Local\\Temp\\
parent_filter:
ParentImage|endswith:
- \explorer.exe
filter:
CommandLine|contains:
- Program Files
condition: selection and parent_filter and not filter
falsepositives:
- Legitimate scripts run by users directly from download or temp folders for administrative
tasks
- Software update or installer scripts staged in temp directories
level: low
tags:
- attack.t1553.005
- attack.defense-impairment
id: f5021866-08d3-5f19-8dbc-588bd43865fc
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/1214-ms.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs