Jump to content


Go to solution Solved by Peter Randziak,

Recommended Posts


Microsoft has issued an advisory regarding the following 0day https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36884

Currently no patches are available and Microsoft mentions that windows defender for office can block the exploit. 

any eset update on the issue? are eset customers protected? 

Thank you!


Link to comment
Share on other sites

I will also note if Eset recommended anti-ransoware HIPS rules are deployed in regards to MS Office apps, this vulnerability can't be exploited;


In current attack chains, the use of the Block all Office applications from creating child processes attack surface reduction rule prevents the vulnerability from being exploited


Edited by itman
Link to comment
Share on other sites

On 7/14/2023 at 9:30 PM, Peter Randziak said:

Hello @Mohsen Ghaffari,

we have a detections in place for payloads used in exploitation of this vulnerability.


Hi @Peter Randziak, can you please share a link to confirm that this vulnerability is covered by ESET?

Thank you

Link to comment
Share on other sites

  • Administrators

ESET detects the payloads depending on their variants. The detections are:

- variant of Win32/Exploit.CVE-2017-0199 (document payloads)

- variants of Win64/Agent (RomCom backdoor)

- variants of Python/Impacket (Impacket framework)

- variants of Win32/Exploit.CVE-2017-0199 (XML payloads)

Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...