Technical intelligence and weaponization dossier for CVE-2017-8570. Documented exploitation across 1 active malware families totaling 43 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-8570 |
|---|---|
| Common Name / Bulletin | Microsoft Office Composite Moniker Remote Code Execution (MS17-014) |
| CWE Classification | CWE-94: Code Injection via Composite Moniker |
| Affected Software & Versions | Microsoft Office 2007, 2010, 2013, 2016 |
| Technical Root Cause | Flaw in Microsoft Office handling composite monikers in OLE documents, enabling attackers to drop and execute scriptlets (.sct) via SCT/scriptlet moniker. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| agenttesla | Infostealer | 43 | Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the t... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-8570 in enterprise networks:
Process creation of scrobj.dll invoked via regsvr32.exe from an Office child process with URL scriptlet argument.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →