Microsoft Patch Tuesday August 2025 critical RCE fixes
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft issued patches for multiple critical RCE vulnerabilities across Exchange, SQL Server, Windows, Office and cloud products; no active exploitation reported.
On August 12, 2025, Microsoft released patches addressing multiple vulnerabilities across a broad range of products and services. The most severe vulnerabilities allow remote code execution in the context of the logged-on user, potentially enabling attackers to install programs, view or modify data, or create new accounts with elevated privileges. The severity of impact depends on the privileges of the compromised user account; administrative accounts face greater risk than those with restricted permissions.
Affected products span Microsoft's enterprise and consumer portfolios, including Exchange Server, SQL Server, Windows Hyper-V, Azure services, Microsoft Office applications (Word, Excel, PowerPoint, SharePoint), Microsoft Edge for Android, Windows kernel components, Remote Desktop Services, Azure Stack, Microsoft Teams, and various Windows subsystems. The advisory notes no current reports of in-the-wild exploitation. CIS-ISAC recommends immediate patching after appropriate testing, implementation of least-privilege principles, automated patch management, and endpoint detection controls.
Detection guidance
Office Application Spawning Script or Command Interpreter
Word, Excel or PowerPoint spawning cmd, PowerShell or script hosts, a common sign of a client-side RCE or malicious document. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script or Command Interpreter
id: 9c565d08-b12c-591b-ba63-2620a8de2184
status: experimental
description: Detects Microsoft Office applications spawning command interpreters or
script hosts. This is typical post-exploitation behaviour after exploitation of
an Office client-side RCE vulnerability or a malicious document. Matches the parent/child
relation, not any specific exploit artefact.
tags:
- attack.execution
- attack.t1203
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection
falsepositives:
- Business macros or add-ins that legitimately launch cmd or PowerShell
- Legacy Excel-based automation that shells out to scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
IIS Worker Process Spawning Command Shell
w3wp.exe (for example Exchange or SharePoint app pools) spawning cmd or PowerShell, indicating webshell or exploitation of a public-facing app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Command Shell
id: b219706c-4ea2-5f2e-9c56-6ca58190c8e9
status: experimental
description: Detects the IIS worker process w3wp.exe spawning a command interpreter
or common living-off-the-land utilities. This is typical of webshell activity or
exploitation of public-facing Exchange, SharePoint or other IIS-hosted applications.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
condition: selection
falsepositives:
- Web applications that intentionally invoke cmd or PowerShell for administrative
functions
- Some SharePoint or Exchange management operations that launch PowerShell from an
app pool
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
SQL Server Process Spawning Command Interpreter
sqlservr.exe spawning cmd or PowerShell, consistent with xp_cmdshell abuse or SQL Server RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Process Spawning Command Interpreter
id: a165512e-2e7d-5fb9-9ddc-13f28e039e57
status: experimental
description: Detects the SQL Server service process spawning cmd, PowerShell or script
hosts. This can indicate xp_cmdshell abuse or post-exploitation after a SQL Server
remote code execution vulnerability.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \sqlservr.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- DBA maintenance jobs that intentionally enable xp_cmdshell
- Legacy SQL Agent jobs running batch files through cmd
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs