CVE-2017-11774 | Microsoft Office - Outlook Operational Intel

Executive Risk Summary

"The Microsoft Outlook Security Feature Bypass Vulnerability allows an attacker to execute arbitrary commands due to how Microsoft Office handles objects in memory. This vulnerability affects Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016."

Anticipated Attack Path

1. Phishing or social engineering to trick the user into opening a malicious email or attachment
2. Exploitation of the vulnerability to execute arbitrary commands
3. Potential lateral movement and further exploitation of the compromised system

Am I Vulnerable?

Verify the version of Microsoft Outlook installed
Check for any suspicious emails or attachments
Monitor system logs for unusual activity

Operational Audit Arsenal

Target Type Process

Target Asset OUTLOOK.EXE

Standard Path C:\Program Files\Microsoft Office\Root\Office16

PowerShell

# 🛠️ Senior Engineer Universal Audit
# Target: OUTLOOK.EXE (Process)
$Targets = 'OUTLOOK.EXE'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")

Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue | 
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}