CVE-2025-21298: Windows OLE RCE via Malicious RTF Document

let suspiciousRTFParents = dynamic(["winword.exe", "outlook.exe", "thunderbird.exe", "mimecast.exe", "explorer.exe"]);
let oleHosts = dynamic(["wordpad.exe", "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe"]);
union
(
  DeviceProcessEvents
  | where TimeGenerated >= ago(7d)
  | where InitiatingProcessFileName in~ (oleHosts)
  | where FileName in~ (suspiciousChildren)
  | extend CommandLineLower = tolower(ProcessCommandLine)
  | where CommandLineLower has_any ("http", "https", "ftp", "\\\\\\\\")
        or CommandLineLower has_any ("invoke-expression", "iex", "downloadstring", "webclient", "start-process", "-enc", "-encodedcommand", "bypass")
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, ReportId
  | extend DetectionReason = "OLE host spawned suspicious child process"
),
(
  DeviceFileEvents
  | where TimeGenerated >= ago(7d)
  | where InitiatingProcessFileName in~ (oleHosts)
  | where FileName endswith ".rtf" or FileName endswith ".doc" or FileName endswith ".docx"
  | where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\")
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ReportId
  | extend DetectionReason = "OLE host wrote suspicious file to temp path"
),
(
  DeviceEvents
  | where TimeGenerated >= ago(7d)
  | where ActionType == "OleObjectLinkFollowed" or ActionType == "ExploitGuardNetworkProtectionAudited"
  | where InitiatingProcessFileName in~ (oleHosts)
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ActionType, AdditionalFields, ReportId
  | extend DetectionReason = "OLE link or exploit guard event from Office host"
)
| summarize count() by TimeGenerated, DeviceName, AccountName, DetectionReason, ReportId
| sort by TimeGenerated desc

index=wineventlog OR index=sysmon sourcetype IN ("xmlwineventlog:microsoft-windows-sysmon/operational", "WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval event_id = coalesce(EventCode, event_id)
| where event_id IN ("1", "11", "7", "3")
| eval parent_lower = lower(ParentImage)
| eval image_lower = lower(Image)
| where (event_id="1" AND
    match(parent_lower, "(winword|excel|powerpnt|outlook|wordpad)\.exe$") AND
    match(image_lower, "(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic)\.exe$"))
  OR (event_id="1" AND
    match(parent_lower, "(winword|excel|powerpnt|outlook|wordpad)\.exe$") AND
    match(lower(CommandLine), "(invoke-expression|iex|downloadstring|webclient|-enc|-encodedcommand|bypass|http://|https://|ftp://)"))
  OR (event_id="11" AND
    match(parent_lower, "(winword|excel|powerpnt|outlook|wordpad)\.exe$") AND
    match(TargetFilename, "(?i)(\\AppData\\Local\\Temp|\\AppData\\Roaming|\\ProgramData)"))
  OR (event_id="3" AND
    match(parent_lower, "(winword|excel|powerpnt|outlook|wordpad)\.exe$") AND
    NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)"))
| eval detection_reason = case(
    event_id="1" AND match(image_lower, "(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$"), "OLE host spawned suspicious child process",
    event_id="1" AND match(lower(CommandLine), "(invoke-expression|downloadstring|-enc)"), "OLE host executed encoded/download command",
    event_id="11", "OLE host wrote file to suspicious temp path",
    event_id="3", "OLE host made unexpected outbound network connection",
    true(), "OLE suspicious activity"
  )
| stats count by _time, ComputerName, User, ParentImage, Image, CommandLine, TargetFilename, DestinationIp, detection_reason
| sort - _time

sequence by host.name, process.parent.pid with maxspan=2m
  [process where event.type == "start"
    and process.parent.name in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "wordpad.exe")
    and process.name in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")]
  [any where event.category in ("file", "network", "process") and
    (file.path like~ "*\\AppData\\Local\\Temp\\*" or
     file.path like~ "*\\ProgramData\\*" or
     network.direction == "outbound")]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "username",
  "sourceip",
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process_name,
  "Command" AS command_line,
  "File Path" AS file_path
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (LOWER("Parent Process Name") IMATCHES '.*(winword|excel|powerpnt|outlook|wordpad)\.exe$'
     AND LOWER("Process Name") IMATCHES '.*(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$')
    OR
    (LOWER("Parent Process Name") IMATCHES '.*(winword|excel|powerpnt|outlook|wordpad)\.exe$'
     AND (LOWER("Command") IMATCHES '.*(invoke-expression|iex|downloadstring|webclient|-encodedcommand|-enc|bypass|http://|https://).*'))
    OR
    (LOWER("Parent Process Name") IMATCHES '.*(winword|excel|powerpnt|outlook|wordpad)\.exe$'
     AND LOWER("File Path") IMATCHES '.*(appdata\\local\\temp|appdata\\roaming|programdata).*')
  )
  AND QIDNAME(qid) IN ('Process Creation', 'File Created', 'Network Connection')
LAST 7 DAYS
ORDER BY devicetime DESC

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| where EventID in ("1", "11", "3")
| parse field=ParentImage "*" as parent_process nodrop
| parse field=Image "*" as child_process nodrop
| parse field=CommandLine "*" as command_line nodrop
| parse field=TargetFilename "*" as target_file nodrop
| where (
    matches(toLowerCase(parent_process), ".*winword\.exe|.*excel\.exe|.*powerpnt\.exe|.*outlook\.exe|.*wordpad\.exe")
    and (
      matches(toLowerCase(child_process), ".*cmd\.exe|.*powershell\.exe|.*wscript\.exe|.*cscript\.exe|.*mshta\.exe|.*rundll32\.exe|.*regsvr32\.exe|.*certutil\.exe")
      or matches(toLowerCase(command_line), ".*(invoke-expression|iex|downloadstring|webclient|-encodedcommand|-enc|bypass|http://|https://).*")
      or matches(toLowerCase(target_file), ".*(appdata\\local\\temp|appdata\\roaming|programdata).*")
    )
  )
| eval detection_category = if(
    matches(toLowerCase(child_process), ".*cmd\.exe|.*powershell\.exe"), "Suspicious child spawned by OLE host",
    if(matches(toLowerCase(command_line), ".*(invoke-expression|downloadstring|-enc).*"), "Encoded/download command from OLE host",
    if(matches(toLowerCase(target_file), ".*(temp|roaming|programdata).*"), "Suspicious file write by OLE host",
    "OLE anomaly")))
| count by _messageTime, Computer, User, parent_process, child_process, command_line, target_file, detection_category
| sort by _messageTime desc

rule cve_2025_21298_ole_rce {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-21298 Windows OLE RCE via malicious RTF document"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298"
    mitre_attack_tactic = "Initial Access, Execution"
    mitre_attack_technique = "T1566.001, T1204.002"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(winword|excel|powerpnt|outlook|wordpad)\.exe$/
    $proc.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/

  match:
    $proc.principal.hostname over 5m

  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "WORDPAD.EXE")
| ImageFileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe")
  OR (CommandLine = /(?i)(invoke-expression|iex|downloadstring|webclient|-encodedcommand|-enc|bypass|http:\/\/|https:\/\/)/ )
| rename ParentBaseFileName as ole_host, ImageFileName as spawned_process
| eval detection_reason = case(
    spawned_process = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe/, "OLE host spawned suspicious shell",
    CommandLine = /(?i)(invoke-expression|downloadstring|-enc|-encodedcommand)/, "OLE host executed encoded/download command",
    true(), "OLE anomaly from Office process"
  )
| table timestamp, ComputerName, UserName, ole_host, spawned_process, CommandLine, detection_reason
| sort timestamp desc