DOCX template injection via CVE-2017-0199
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA reports a malicious DOCX file exploiting CVE-2017-0199 to download external Word templates from a private IP.
CISA analysis identified a Microsoft Word DOCX file designed to exploit CVE-2017-0199, a known vulnerability in Office's external template loading mechanism. The malicious document contains a modified settings.xml.rels file pointing to an external template URL (hxxp://192.168.10.102/1.doc) and attempts to deceive users into enabling macros, though the document contains no actual macros. When opened in Microsoft Word, the application will attempt to fetch the template from the specified private IP address, potentially delivering malware or additional payloads. The template URL points to a private RFC1918 address, suggesting this was a targeted or internal attack. The actual template file was not available for analysis at the time of this report. CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office that allows attackers to execute arbitrary code through specially crafted Office documents that reference external resources.
Mentioned in this report
Detection guidance
Word Process Connecting to Private IP over HTTP (Remote Template Fetch)
WINWORD.EXE opening an outbound HTTP connection to an RFC1918 address, consistent with CVE-2017-0199 style external template loading from a settings.xml.rels reference. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Word Process Connecting to Private IP over HTTP (Remote Template Fetch)
description: Detects WINWORD.EXE initiating an outbound connection on common HTTP
ports to an RFC1918 address. Word fetching a remote template/document this way is
typical of CVE-2017-0199 template injection (external template URL in settings.xml.rels).
Generalises on process, port and private destination range, not on a specific IP
or file name.
status: experimental
tags:
- attack.execution
- attack.t1559.001
- attack.t1204.002
- attack.initial-access
- attack.t1566.001
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \WINWORD.EXE
Initiated: 'true'
DestinationPort:
- 80
- 8080
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection
falsepositives:
- Users opening documents or templates hosted on internal HTTP-only intranet or SharePoint
servers
- Internal document management systems that serve templates over plain HTTP
level: medium
id: e84dbd9f-12f4-5e46-a5ca-a22fc7347aad
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133h
Office Application Spawning Script or LOLBin Child Process
Word, Excel or PowerPoint spawning mshta, script hosts, shells or download LOLBins - typical post-exploitation of CVE-2017-0199 and malicious document execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script or LOLBin Child Process
description: Detects Microsoft Office applications spawning scripting hosts, command
shells or download/proxy-execution binaries. This is the typical follow-on stage
after an Office document exploits CVE-2017-0199 and retrieves a remote payload (for
example HTA or script content).
status: experimental
tags:
- attack.execution
- attack.t1204.002
- attack.t1559.001
- attack.initial-access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith:
- \mshta.exe
- \wscript.exe
- \cscript.exe
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \regsvr32.exe
- \rundll32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Legitimate Office macros or add-ins that invoke cmd.exe or PowerShell for business
automation
- Software deployment or reporting tools that drive Office through scripts
level: high
id: 30bace5c-52bb-51a1-8518-936929b1f49c
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133h
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133h
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs