Malicious XLSX Dropper Targets Systems via CVE-2017-11882

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

CISA reports a protected Excel file exploiting CVE-2017-11882 to download and execute malware payloads.

CISA analyzed a Microsoft Excel Open XML Format (XLSX) spreadsheet file with a protected workbook containing hidden malicious code. When opened, the file attempts to download and execute a payload via a URL shortener (urlz.fr/7pMA), which resolves to 151.106.30.115 hosting win32.exe. The malware executes from %AppData%\Roaming\svchost.exe. The malicious payload itself was unavailable during analysis. The threat leverages CVE-2017-11882, a known Office vulnerability affecting Excel and Word, to achieve remote code execution without user interaction beyond opening the file. The command-and-control IP is hosted in France by Velia.net; the shortening service uses an anonymous registrant.

title: Excel Spawning Child Process Consistent with CVE-2017-11882 Exploitation
description: Detects Excel/Word spawning cmd, PowerShell, mshta, bitsadmin, certutil
  or similar. The EQNEDT32 exploit chain typically runs a shell or downloader from
  the Office process tree. Generalises on the parent/child relation, not on the campaign
  URL or payload name.
tags:
- attack.execution
- attack.t1203
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \EXCEL.EXE
    - \WINWORD.EXE
    - \EQNEDT32.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \bitsadmin.exe
    - \certutil.exe
    - \wscript.exe
    - \cscript.exe
    - \regsvr32.exe
    - \rundll32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Excel macros or add-ins that invoke cmd.exe for business automation
- Software packaging or reporting tools that drive Office and call helper scripts
level: high
id: 04823eff-07f6-5834-bcac-35b5fb7b8096
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133e

title: Equation Editor EQNEDT32 Spawning Child Process
description: Detects the legacy Equation Editor process EQNEDT32.EXE creating a child
  process, a strong indicator of CVE-2017-11882 exploitation from a malicious Office
  document.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \EQNEDT32.EXE
  condition: selection
falsepositives:
- Rare legacy documents that launch helper programs through Equation Editor
level: high
id: ae53a774-bd18-57c1-88a8-cdbf8b5faa34
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133e

title: Svchost Executable Launched from User AppData Roaming
description: Detects a binary named svchost.exe executing from a user AppData\Roaming
  directory instead of System32. The legitimate svchost.exe only runs from System32
  or SysWOW64, so this indicates masquerading by a downloaded payload.
tags:
- attack.command-and-control
- attack.t1105
- attack.stealth
- attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: \AppData\Roaming\
    Image|endswith: \svchost.exe
  condition: selection
falsepositives:
- Unlikely; possibly a portable tool deliberately renamed by a developer for testing
level: high
id: 6e3b849c-52f4-57d4-ba5b-8b8f733774c5
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133e

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133e