Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2025-21298.
Upgrade to ProDetect CVE-2025-21298: Windows OLE RCE via Malicious RTF Document in Microsoft Sentinel
Detects exploitation of CVE-2025-21298, a use-after-free (CWE-416) vulnerability in Windows OLE that allows remote code execution when a user opens a specially crafted RTF document. With a CVSS score of 9.8 and public PoC availability, this is a critical-severity vulnerability affecting Windows 10, 11, and Server 2008-2025. Exploitation typically involves phishing emails with RTF attachments that trigger the OLE subsystem to execute attacker-controlled code in the context of the victim user.
MITRE ATT&CK
KQL Detection Query
let suspiciousRTFParents = dynamic(["winword.exe", "outlook.exe", "thunderbird.exe", "mimecast.exe", "explorer.exe"]);
let oleHosts = dynamic(["wordpad.exe", "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe"]);
union
(
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ (oleHosts)
| where FileName in~ (suspiciousChildren)
| extend CommandLineLower = tolower(ProcessCommandLine)
| where CommandLineLower has_any ("http", "https", "ftp", "\\\\\\\\")
or CommandLineLower has_any ("invoke-expression", "iex", "downloadstring", "webclient", "start-process", "-enc", "-encodedcommand", "bypass")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, ReportId
| extend DetectionReason = "OLE host spawned suspicious child process"
),
(
DeviceFileEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ (oleHosts)
| where FileName endswith ".rtf" or FileName endswith ".doc" or FileName endswith ".docx"
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ReportId
| extend DetectionReason = "OLE host wrote suspicious file to temp path"
),
(
DeviceEvents
| where TimeGenerated >= ago(7d)
| where ActionType == "OleObjectLinkFollowed" or ActionType == "ExploitGuardNetworkProtectionAudited"
| where InitiatingProcessFileName in~ (oleHosts)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ActionType, AdditionalFields, ReportId
| extend DetectionReason = "OLE link or exploit guard event from Office host"
)
| summarize count() by TimeGenerated, DeviceName, AccountName, DetectionReason, ReportId
| sort by TimeGenerated descDetects CVE-2025-21298 OLE RCE exploitation by correlating Office/OLE host processes spawning suspicious child processes, writing files to temp paths, or triggering OLE link events. Covers both direct exploitation and post-exploitation activity from malicious RTF documents.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macro-enabled documents that spawn cmd.exe for business automation tasks
- IT admin tools that use OLE embedding for legitimate deployment workflows
- Security testing tools or red team exercises using RTF documents
- Document conversion utilities that spawn child processes as part of normal operation
- Outlook add-ins that legitimately invoke shell commands via OLE
Other platforms for CVE-2025-21298
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1RTF OLE Object Spawning CMD via WordPad
Expected signal: Sysmon EID 1: wordpad.exe spawning cmd.exe with parent-child relationship. DeviceProcessEvents in MDE showing InitiatingProcessFileName=wordpad.exe, FileName=cmd.exe.
- Test 2Simulate OLE Host Encoded PowerShell Download
Expected signal: Sysmon EID 1 with CommandLine containing '-EncodedCommand' or '-enc'. DeviceProcessEvents with ProcessCommandLine matching encoded command patterns.
- Test 3RTF File Drop to INetCache Simulating Email Attachment Open
Expected signal: Sysmon EID 11 (File Create): RTF file written to INetCache path with Outlook or Explorer as initiating process. DeviceFileEvents showing FileName ending in .rtf in INetCache path.
- Test 4OLE Host Unexpected Outbound Network Connection
Expected signal: Sysmon EID 3: Network connection event from powershell.exe (simulating Office host) to external IP on port 80. DeviceNetworkEvents showing InitiatingProcessFileName and DestinationIP for external address.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2025-21298 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month