Detect CVE-2025-21298: Windows OLE RCE via Malicious RTF Document in Google Chronicle
Detects exploitation of CVE-2025-21298, a use-after-free (CWE-416) vulnerability in Windows OLE that allows remote code execution when a user opens a specially crafted RTF document. With a CVSS score of 9.8 and public PoC availability, this is a critical-severity vulnerability affecting Windows 10, 11, and Server 2008-2025. Exploitation typically involves phishing emails with RTF attachments that trigger the OLE subsystem to execute attacker-controlled code in the context of the victim user.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2025_21298_ole_rce {
meta:
author = "df00tech"
description = "Detects CVE-2025-21298 Windows OLE RCE via malicious RTF document"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298"
mitre_attack_tactic = "Initial Access, Execution"
mitre_attack_technique = "T1566.001, T1204.002"
events:
$proc.metadata.event_type = "PROCESS_LAUNCH"
$proc.principal.process.file.full_path = /(?i)(winword|excel|powerpnt|outlook|wordpad)\.exe$/
$proc.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/
match:
$proc.principal.hostname over 5m
condition:
$proc
}Chronicle YARA-L rule for CVE-2025-21298: detects PROCESS_LAUNCH events where an Office/OLE host spawns a suspicious child process, indicative of RTF-triggered OLE use-after-free exploitation leading to RCE.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Office macros that spawn shell commands for business automation
- IT management tooling using OLE embedding for software deployment
- Third-party Office add-ins that invoke command-line tools as part of normal operation
- Security testing or red team exercises using RTF-based payloads in authorized environments
- Document workflow automation that uses cmd.exe for output processing
Other platforms for CVE-2025-21298
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1RTF OLE Object Spawning CMD via WordPad
Expected signal: Sysmon EID 1: wordpad.exe spawning cmd.exe with parent-child relationship. DeviceProcessEvents in MDE showing InitiatingProcessFileName=wordpad.exe, FileName=cmd.exe.
- Test 2Simulate OLE Host Encoded PowerShell Download
Expected signal: Sysmon EID 1 with CommandLine containing '-EncodedCommand' or '-enc'. DeviceProcessEvents with ProcessCommandLine matching encoded command patterns.
- Test 3RTF File Drop to INetCache Simulating Email Attachment Open
Expected signal: Sysmon EID 11 (File Create): RTF file written to INetCache path with Outlook or Explorer as initiating process. DeviceFileEvents showing FileName ending in .rtf in INetCache path.
- Test 4OLE Host Unexpected Outbound Network Connection
Expected signal: Sysmon EID 3: Network connection event from powershell.exe (simulating Office host) to external IP on port 80. DeviceNetworkEvents showing InitiatingProcessFileName and DestinationIP for external address.
Response Playbook
Triage
- Identify the source of the RTF document: check email headers, download history, USB transfer logs, or network share access to determine how the file reached the endpoint.
- Examine process tree from the OLE host (winword.exe, wordpad.exe, outlook.exe): capture the full parent-child chain, command lines, and any injected threads using EDR telemetry or Sysmon Event ID 1.
- Check for signs of lateral movement or persistence: review scheduled tasks (Sysmon EID 1 with schtasks.exe), registry run keys (Sysmon EID 13), and new user accounts (Windows Security EID 4720) created around the time of the alert.
- Validate if the affected host is patched: confirm Windows Update history or WSUS/SCCM patch status for January 2025 Patch Tuesday (KB for CVE-2025-21298).
Containment
- Isolate the affected endpoint immediately via EDR network isolation or firewall ACL to prevent lateral movement or C2 callbacks while investigation proceeds.
- Block the malicious RTF file hash at the email gateway, web proxy, and endpoint AV/EDR to prevent further delivery or execution across the environment.
Evidence Collection
- Collect a memory dump of the Office/OLE host process (winword.exe, wordpad.exe) using WinPmem or EDR live memory acquisition to capture in-memory payloads, shellcode, and heap artifacts indicative of use-after-free exploitation.
- Preserve Sysmon logs, Windows Security Event Logs, and prefetch files from %SystemRoot%\Prefetch for all processes involved in the process tree originating from the OLE host, retaining originals for forensic chain of custody.
Escalation Criteria
- !Escalate to IR leadership and CISO if there is evidence of successful C2 communication (outbound connections from spawned child processes to external IPs) or if credential dumping tools (mimikatz, procdump targeting lsass) were executed.
- !Escalate if more than one host in the environment shows indicators of compromise consistent with the same RTF document or attacker TTPs, suggesting a targeted campaign or widespread phishing wave.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1: process creation events showing Office/OLE host as parent with suspicious child processes - >
Sysmon Event ID 3: network connections from Office/OLE hosts to external IPs shortly after document open - >
Sysmon Event ID 7: DLL load events in Office process space showing unexpected or unsigned DLLs loaded post-exploitation - >
Windows Prefetch: entries for cmd.exe, powershell.exe, or other LOLBins with timestamps correlated to document open time - >
MRU registry keys: HKCU\Software\Microsoft\Office\<version>\Word\File MRU to identify recently opened RTF documents - >
Email artifacts: .eml or .msg files in user's mailbox or email gateway quarantine containing the malicious RTF attachment - >
Memory artifacts: heap spray patterns or use-after-free indicators in OLE32.DLL or OLEAUT32.DLL address space
Tuning Guidance
Baseline your environment's normal Office macro usage before deploying with high confidence. In environments with heavy macro use, tighten the child process filter to focus only on net.exe, nltest.exe, and known C2 download LOLBins rather than all shells. Consider adding file hash allowlisting for known-good automation scripts. For Outlook specifically, the ExploitGuardNetworkProtectionAudited event (DeviceEvents) provides a high-fidelity signal with fewer false positives than process creation alone. Tune the 'encoded command' regex to match your baseline PowerShell usage — some environments legitimately encode long arguments. If Microsoft AMSI is enabled, correlate with AMSI scan events for additional fidelity. Set severity to 'high' rather than 'critical' on endpoints confirmed to be running the patched January 2025 update.
Hunting Queries
Threat hunt for RTF files written by email clients or browsers to download/temp paths in the past 30 days — surfaces initial delivery of CVE-2025-21298 weaponized documents before exploitation chain is triggered.
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName endswith ".rtf"
| where InitiatingProcessFileName in~ ("outlook.exe", "thunderbird.exe", "chrome.exe", "firefox.exe", "msedge.exe", "explorer.exe")
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\Microsoft\\Windows\\INetCache\\")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated descindex=sysmon EventID=11
| where match(TargetFilename, "(?i)\.rtf$")
| where match(lower(Image), "(outlook|thunderbird|chrome|firefox|msedge|explorer)\.exe$")
| where match(lower(TargetFilename), "(downloads|appdata\\local\\temp|inetcache)")
| table _time, ComputerName, User, Image, TargetFilename
| sort - _timeFrequency analysis hunt: identifies hosts where OLE host processes have spawned suspicious children more than twice or with varied command lines in a 1-hour window, suggesting active exploitation or persistence activity consistent with CVE-2025-21298.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("winword.exe", "wordpad.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| summarize SpawnCount = count(), UniqueCommands = dcount(ProcessCommandLine) by DeviceName, InitiatingProcessFileName, FileName, bin(TimeGenerated, 1h)
| where SpawnCount > 2 or UniqueCommands > 1
| sort by TimeGenerated descindex=sysmon EventID=1
| where match(lower(ParentImage), "(winword|wordpad|excel|powerpnt|outlook)\.exe$")
| where match(lower(Image), "(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$")
| bin _time span=1h
| stats count as spawn_count, dc(CommandLine) as unique_cmds by _time, ComputerName, User, ParentImage, Image
| where spawn_count > 2 OR unique_cmds > 1
| sort - _timeAtomic Red Team Tests
Simulates CVE-2025-21298 exploitation chain by crafting a minimal RTF file with an embedded OLE object that causes WordPad to spawn cmd.exe. This replicates the process-creation telemetry generated during real exploitation.
Command
# Step 1: Create a minimal RTF with OLE shell command trigger (lab only)
$rtfContent = @'
{\rtf1\ansi {\object\objemb\objw1\objh1{\*\objclass Shell.Application}{\objdata 0100000002000000}}}
'@
$rtfPath = "$env:TEMP\\test_ole_rce.rtf"
$rtfContent | Out-File -FilePath $rtfPath -Encoding ASCII
# Step 2: Open with WordPad to trigger OLE parsing
Start-Process -FilePath "wordpad.exe" -ArgumentList $rtfPath -Wait
# Step 3: Separately simulate the child process spawn for telemetry
Start-Process -FilePath "wordpad.exe" -PassThru | ForEach-Object {
Start-Sleep -Seconds 2
Start-Process -FilePath "cmd.exe" -ArgumentList "/c echo CVE-2025-21298 simulation > $env:TEMP\\ole_test_output.txt"
}Cleanup
Remove-Item -Path "$env:TEMP\\test_ole_rce.rtf" -ErrorAction SilentlyContinue; Remove-Item -Path "$env:TEMP\\ole_test_output.txt" -ErrorAction SilentlyContinueExpected Telemetry
Sysmon EID 1: wordpad.exe spawning cmd.exe with parent-child relationship. DeviceProcessEvents in MDE showing InitiatingProcessFileName=wordpad.exe, FileName=cmd.exe.
Expected Detection
KQL and SPL queries should fire on the wordpad.exe -> cmd.exe process creation relationship.
Simulates post-exploitation behavior where an OLE host process (using PowerShell impersonating the parent) executes an encoded PowerShell command mimicking a C2 download stager, generating the command-line telemetry expected from CVE-2025-21298 exploitation.
Command
# Encode a benign command to simulate obfuscated stager telemetry
$benignCommand = "Write-Output 'CVE-2025-21298 atomic test - no actual payload'"
$encodedCommand = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($benignCommand))
# Launch from a renamed powershell to simulate OLE parent context
$parentSim = Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -Command `$host.UI.RawUI.WindowTitle='WINWORD.EXE simulation'" -PassThru
Start-Sleep -Seconds 1
# Execute encoded command as child process
powershell.exe -EncodedCommand $encodedCommand
$parentSim | Stop-Process -ErrorAction SilentlyContinueCleanup
Stop-Process -Name 'powershell' -ErrorAction SilentlyContinueExpected Telemetry
Sysmon EID 1 with CommandLine containing '-EncodedCommand' or '-enc'. DeviceProcessEvents with ProcessCommandLine matching encoded command patterns.
Expected Detection
KQL and SPL queries matching on '-encodedcommand' or '-enc' in command line from Office/OLE parent context. Chronicle and CrowdStrike rules match on encoded command regex.
Simulates the delivery phase of CVE-2025-21298 by replicating how Outlook writes an RTF attachment to the INetCache temporary directory before opening it, generating the file creation telemetry used in threat hunting queries.
Command
# Simulate Outlook dropping RTF to INetCache (delivery phase)
$inetCachePath = "$env:LOCALAPPDATA\\Microsoft\\Windows\\INetCache\\Content.Outlook"
If (-not (Test-Path $inetCachePath)) { New-Item -ItemType Directory -Path $inetCachePath -Force }
$fakeMaliciousRtf = "$inetCachePath\\malicious_invoice_$(Get-Random).rtf"
'{\rtf1\ansi {\b CVE-2025-21298 atomic test document}}' | Out-File -FilePath $fakeMaliciousRtf -Encoding ASCII
Write-Output "RTF dropped to: $fakeMaliciousRtf"
# Simulate opening with default handler
Invoke-Item $fakeMaliciousRtfCleanup
Remove-Item -Path "$env:LOCALAPPDATA\\Microsoft\\Windows\\INetCache\\Content.Outlook\\malicious_invoice_*.rtf" -ErrorAction SilentlyContinueExpected Telemetry
Sysmon EID 11 (File Create): RTF file written to INetCache path with Outlook or Explorer as initiating process. DeviceFileEvents showing FileName ending in .rtf in INetCache path.
Expected Detection
Threat hunting queries for RTF delivery should surface this file creation event. File monitoring rules correlating .rtf writes from email clients to INetCache should alert.
Simulates CVE-2025-21298 post-exploitation C2 callback behavior by having a process (simulating a compromised Office host) initiate an outbound HTTP connection to an external IP, generating network telemetry used in detection queries.
Command
# Simulate outbound C2 connection from OLE host context (using innocuous test endpoint)
# WARNING: Only run in isolated lab with internet egress allowed for testing
$testUrl = "http://example.com/ole_rce_test"
try {
$result = Invoke-WebRequest -Uri $testUrl -TimeoutSec 5 -ErrorAction Stop
Write-Output "Connection test result: $($result.StatusCode)"
} catch {
Write-Output "Connection attempt made (error expected in air-gapped labs): $($_.Exception.Message)"
}
# Also test DNS resolution telemetry
[System.Net.Dns]::GetHostAddresses("example.com") | ForEach-Object { Write-Output "Resolved: $($_.IPAddressToString)" }Cleanup
# No persistent changes to clean upExpected Telemetry
Sysmon EID 3: Network connection event from powershell.exe (simulating Office host) to external IP on port 80. DeviceNetworkEvents showing InitiatingProcessFileName and DestinationIP for external address.
Expected Detection
KQL query network connection variant and SPL EID 3 detection should identify outbound connection from OLE host context to external IP.