VORANT. Threat Intelligence Research Create a free account

Microsoft patches 70+ flaws in December 2024 rollup

Published Vorant ratingroutine vulnerability Several sectors (10)Government (National), Financial Services, Healthcare, Education, Manufacturing, Telecommunications, Transportation, Retail, Technology, Infrastructure

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Microsoft's December 2024 Patch Tuesday addresses multiple critical vulnerabilities across Windows, Office, Edge, and server products, with remote code execution risks being the most severe.

Sourcecisecurity.org — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

Microsoft released its December 2024 security update addressing numerous vulnerabilities across its product portfolio. The most severe flaws could enable remote code execution in the context of the logged-on user, potentially allowing attackers to install programs, manipulate data, or create privileged accounts. Impact severity depends on the victim's privilege level, with administrative users facing greater risk than those with restricted permissions.

Affected products span the Microsoft ecosystem including Windows core components (kernel, Task Scheduler, file systems), Office applications (Word, Excel, Access, Publisher, SharePoint), Edge browser, Remote Desktop services, Hyper-V virtualization, and network infrastructure components like DNS Server and RRAS. The advisory notes no active exploitation has been observed in the wild at the time of publication.

Organizations should prioritize patching systems with administrative access and internet-facing services. The MS-ISAC rates the risk as high for government and business environments, recommending immediate application of available patches through standard update channels.

Related reporting

Detection guidance

Office Application Spawning Script Interpreter or Command Shell

ATT&CK T1203 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects Office applications (Word, Excel, Access, Publisher) spawning command interpreters or scripting engines, a common post-exploitation behavior following client-side RCE such as the Office vulnerabilities patched in December 2024. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Spawning Script Interpreter or Command Shell
id: 6d5b2cf8-06f3-590c-aadf-ddced5be27cc
status: experimental
description: Detects Microsoft Office applications spawning command shells or scripting
  engines, which is a common indicator of exploitation for client execution (e.g.
  via malicious documents leveraging Office RCE vulnerabilities).
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \MSACCESS.EXE
    - \MSPUB.EXE
    - \POWERPNT.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
  filter:
    CommandLine|contains:
    - \Program Files\Microsoft Office
  condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate Office macros or add-ins that invoke scripting components for business
  automation
- Document templates that call approved VBA-to-shell integrations
level: medium
tags:
- attack.t1203
- attack.execution
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-december-10-2024_2024-135

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs