CVE-2022-44698 in microsoft windows 10 1607
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Windows SmartScreen Security Feature Bypass Vulnerability
Affected software: microsoft windows 10 1607, microsoft windows 10 1809, microsoft windows 10 20h2, microsoft windows 10 21h1, microsoft windows 10 21h2, microsoft windows 10 22h2, microsoft windows 11 21h2, microsoft windows server 2016, microsoft windows server 2019, microsoft windows server 2022
Scores
- CVSS: 5.4 (medium)
- EPSS: 74.99% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-12-13, used in ransomware
- Published: 2022-12-13
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the December 2022 Windows cumulative update (SmartScreen bypass CVE-2022-44698)
Patch or upgrade. Installs Microsoft's December 13, 2022 security update, which fixes SmartScreen so files with a malformed Authenticode signature no longer bypass the Mark-of-the-Web warning. This closes the bypass that Magniber ransomware used.
Applies to: Windows 10 1607, 1809, 20H2, 21H1, 21H2, 22H2; Windows 11 21H2 and 22H2; Windows Server 2016, 2019 and 2022 without the December 2022 cumulative update or a later one.
- List the affected hosts: Windows 10 (1607, 1809, 20H2, 21H1, 21H2, 22H2), Windows 11 21H2/22H2 and Windows Server 2016, 2019 and 2022.
- In Windows Update, WSUS, Intune or ConfigMgr, approve the December 13, 2022 cumulative update or any later one (cumulative updates include this fix).
- For reference, the December 2022 KBs are: Windows 10 20H2/21H2/22H2 KB5021233, Windows 11 21H2 KB5021234, Windows 11 22H2 KB5021255, Windows 10 1809 / Server 2019 KB5021237, Windows 10 1607 / Server 2016 KB5021235, Server 2022 KB5021249. Check these numbers against the MSRC update guide for each build.
- Deploy the update and restart the hosts.
- Confirm the install: run 'Get-HotFix' or 'winver' and check that the OS build is at or above the December 2022 build for that version.
- Until the hosts are patched, block .js, .jse, .vbs and .wsf attachments at the mail gateway and set the default handler for .js files to Notepad through Group Policy.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.