Windows OLE Zero Click Vulnerability Let Attacker To Execute Arbitrary Code
Query
EmailAttachmentInfo
| where FileName endswith ".rtf"
| join kind=inner (EmailEvents) on $left.NetworkMessageId == $right.NetworkMessageId
| extend Geo_IP = tostring(geo_info_from_ip_address(SenderIPv4).country)
| where SenderMailFromDomain !in ("trusteddomain1","trusteddomain2")
| summarize make_set(RecipientEmailAddress) by SenderDisplayName, SenderFromAddress, SenderIPv4,Geo_IP, FileName, SubjectAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1203 | Exploitation for Client Execution |
Author: Sergio Albea (04/02/2025)
Critical Windows OLE Zero-Click Vulnerability Let Attacker to Execute Arbitrary Code
Description: A serious security flaw, tracked as CVE-2025-21298, has been found in Microsoft's Windows OLE technology. This zero-click bug, rated 9.8 on the CVSS scale, lets attackers remotely run malicious code by targeting Microsoft Outlook and other apps—no user interaction needed.
The issue lies in how a specific function handles OLE objects inside RTF files. Attackers can take advantage of this by sending a malicious email with an RTF attachment. Just opening or even previewing the email in Microsoft Outlook is enough to trigger the exploit, letting attackers run code on the system without any user action needed.
This KQL Query helps to detect emails received with a .RTF file attached. It includes the option to whitelist some TrustedDomains to avoid False Positives.
Explanation
This KQL query is designed to help detect potentially malicious emails that contain RTF (Rich Text Format) file attachments, which could exploit a serious security vulnerability in Windows OLE technology. Here's a simple breakdown of what the query does:
-
Filter for RTF Attachments: It starts by looking for email attachments with filenames ending in ".rtf", which are known to potentially exploit the vulnerability.
-
Join with Email Events: The query then joins this information with email event data to correlate the attachment with specific email messages.
-
Geolocation Information: It extends the data by adding geolocation information based on the sender's IP address, identifying the country from which the email was sent.
-
Exclude Trusted Domains: To reduce false positives, it excludes emails from certain trusted domains (e.g., "trusteddomain1", "trusteddomain2").
-
Summarize Results: Finally, it summarizes the results by listing the recipients of these emails, along with details about the sender (name, email address, IP address, country), the filename of the attachment, and the email subject.
This query is useful for identifying potentially harmful emails that could exploit the vulnerability, allowing security teams to take action to protect their systems.
