NexurAI
Code execution triggered by a user opening a document - the phishing payoff.
Not every attack hits a server - many arrive as a document. This path covers client-side code execution (and zero-click credential leaks) triggered by a user receiving or opening a file, the payoff of a phishing campaign, and how to catch Office/Outlook doing things they never should.
A Word document can invoke the ms-msdt: URI protocol to run PowerShell - code execution even with macros disabled.
Microsoft Support Diagnostic Tool (MSDT) · 2022
A malicious Office doc (often via a remote template) calls ms-msdt: with a crafted command; MSDT executes it, giving the attacker code execution on open.
Alert on WINWORD.EXE/ONENOTE.EXE spawning msdt.exe or sdiagnhost.exe, and on 'ms-msdt:' or 'IT_BrowseForFile' strings; hunt for suspicious PowerShell children of Office.
Apply the patch; as a stopgap, unregister the ms-msdt URL protocol and enable Office Protected View / ASR rules.
A zero-click flaw: a crafted calendar/email reminder with a UNC path makes Outlook authenticate to the attacker, leaking Net-NTLMv2 - no user interaction.
Microsoft Outlook (reminder UNC path) · 2023
The attacker sends an appointment with PidLidReminderFileParameter pointing to a UNC path on their server; Outlook connects on reminder, leaking the NTLM hash to relay or crack.
Hunt for outbound SMB (445) to external/unknown hosts from user workstations, and use Microsoft's script to scan mailboxes for malicious reminder properties.
Patch Outlook, block outbound SMB to the internet, add users to Protected Users / enforce SMB signing, and run the mailbox-scanning script.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.