CVE coverage

CVE-2017-0199

CVSS 7.8 Actively exploited (KEV) 8 detections found

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Detection rules

Source	Rule	Status	Updated
suricata	ET WEB_CLIENT Office Requesting .HTA File Likely CVE-2017-0199 Request	rev 5	2024-04-21
suricata	ET WEB_CLIENT Office UA FB SET	rev 3	2024-04-20
suricata	ET EXPLOIT CVE-2017-0199 Common Obfus Stage 2 DL	rev 3	2024-03-14
suricata	ET WEB_CLIENT Office Discovery HTA file Likely CVE-2017-0199 Request M2	rev 3	2020-10-09
snort	ET CURRENT_EVENTS CVE-2017-0199 Common Obfus Stage 2 DL	rev 1	2017-06-19
snort	ET WEB_CLIENT Office Requesting .HTA File Likely CVE-2017-0199 Request	rev 4	2017-06-06
snort	ET WEB_CLIENT Office UA FB SET	rev 2	2017-04-19
snort	ET WEB_CLIENT Office Discovery HTA file Likely CVE-2017-0199 Request M2	rev 2	2017-04-19