T1566.001 Spearphishing Attachment Mappings

CrowdStrike Falcon Hardware Enhanced Exploit Detection (HEED) is an advanced security feature that integrates Intel Processor Trace (Intel PT) technology to provide enhanced visibility into sophisticated attack techniques, including real-time detection of exploits delivered via spearphishing attachments. These attacks often involve adversaries exploiting vulnerabilities within applications or services to execute malicious code once a user interacts with a compromised attachment, enabling attackers to manipulate system behavior and compromise security. Intel PT offers deep insights into program execution at the hardware level, capturing critical telemetry such as control flow, memory access, and instruction execution in real time. This detailed telemetry helps security teams detect abnormal behaviors, such as suspicious execution flows or unexpected interactions triggered by malicious attachments, as well as attempts to hijack legitimate processes. By monitoring these low-level activities, HEED makes it easier to identify exploitation attempts that are often used in spearphishing campaigns to gain unauthorized access or deploy malware. By combining Intel PT’s granular telemetry with advanced detection algorithms, HEED provides a powerful defense against evasive spearphishing attacks that may bypass traditional security measures. This proactive approach enables organizations to quickly identify and mitigate exploits delivered through malicious attachments, strengthening the protection of critical systems and reducing the risk of compromise from advanced, targeted cyber threats.

CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office. The vulnerability is ideal for phishing campaigns, and it enables RCE on vulnerable systems.

This vulnerability is exploited via a maliciously-crafted pdf delivered as an email attachment.

This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.

CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions.

CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities. The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights.