Microsoft patches 70+ flaws in December 2024 rollup

9 June 2026 high vulnerability government-nationalfinancial-serviceshealthcareeducationmanufacturingtelecommunicationstransportationretailtechnologyinfrastructure

Microsoft's December 2024 Patch Tuesday addresses multiple critical vulnerabilities across Windows, Office, Edge, and server products, with remote code execution risks being the most severe.

Microsoft released its December 2024 security update addressing numerous vulnerabilities across its product portfolio. The most severe flaws could enable remote code execution in the context of the logged-on user, potentially allowing attackers to install programs, manipulate data, or create privileged accounts. Impact severity depends on the victim's privilege level, with administrative users facing greater risk than those with restricted permissions.

Affected products span the Microsoft ecosystem including Windows core components (kernel, Task Scheduler, file systems), Office applications (Word, Excel, Access, Publisher, SharePoint), Edge browser, Remote Desktop services, Hyper-V virtualization, and network infrastructure components like DNS Server and RRAS. The advisory notes no active exploitation has been observed in the wild at the time of publication.

Organizations should prioritize patching systems with administrative access and internet-facing services. The MS-ISAC rates the risk as high for government and business environments, recommending immediate application of available patches through standard update channels.

Detection guidance

Office Application Spawning Script Interpreter or Command Shell

ATT&CK T1203

Detects Office applications (Word, Excel, Access, Publisher) spawning command interpreters or scripting engines, a common post-exploitation behavior following client-side RCE such as the Office vulnerabilities patched in December 2024. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Spawning Script Interpreter or Command Shell
id: 6d5b2cf8-06f3-590c-aadf-ddced5be27cc
status: experimental
description: Detects Microsoft Office applications spawning command shells or scripting
  engines, which is a common indicator of exploitation for client execution (e.g.
  via malicious documents leveraging Office RCE vulnerabilities).
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \MSACCESS.EXE
    - \MSPUB.EXE
    - \POWERPNT.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
  filter:
    CommandLine|contains:
    - \Program Files\Microsoft Office
  condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate Office macros or add-ins that invoke scripting components for business
  automation
- Document templates that call approved VBA-to-shell integrations
level: medium
tags:
- attack.t1203
- attack.execution
author: Vorant

Task Scheduler Host Process Spawning Unexpected Child Process

ATT&CK T1068

Detects the Task Scheduler service host (svchost.exe running the Schedule service or taskeng.exe) spawning an unusual child process, which may indicate exploitation of a Task Scheduler privilege escalation vulnerability such as those patched in December 2024. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Task Scheduler Host Process Spawning Unexpected Child Process
id: 4bcac703-7fbe-5713-9e69-f510b01467de
status: experimental
description: Detects svchost.exe hosting the Schedule (Task Scheduler) service, or
  taskeng.exe, spawning a process that is not a standard scheduled task executable,
  which can indicate exploitation of a Task Scheduler privilege escalation vulnerability.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \svchost.exe
    - \taskeng.exe
    ParentCommandLine|contains: Schedule
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \net.exe
    - \net1.exe
  filter:
    Image|endswith:
    - \taskhostw.exe
  condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate scheduled tasks configured by administrators to run scripts or maintenance
  commands
- Third-party backup or patch management software that registers scheduled tasks invoking
  cmd/powershell
level: medium
tags:
- attack.t1068
- attack.privilege-escalation
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-december-10-2024_2024-135

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free