Attack Chain

1. Vulnerability Identification: Attacker identifies a system running a Microsoft product vulnerable to CVE-2017-3735.
2. Exploit Development/Acquisition: Attacker develops a custom exploit or obtains an existing exploit for CVE-2017-3735.
3. Initial Access: Attacker leverages the exploit to gain initial access to the targeted system. This step is specific to the product affected, and might involve network protocols or local execution.
4. Privilege Escalation (If Required): If the initial access is limited, the attacker might attempt to escalate privileges to gain higher-level control over the system.
5. Payload Deployment: The attacker deploys a malicious payload onto the compromised system. This could be malware, a backdoor, or other malicious tools.
6. Command and Control: The attacker establishes a command and control (C2) channel with the compromised system to remotely control it and exfiltrate data.
7. Lateral Movement (Optional): The attacker moves laterally to other systems within the network, compromising additional assets.
8. Objective Completion: The attacker achieves their final objective, such as data theft, system disruption, or financial gain.

Impact

Successful exploitation of CVE-2017-3735 can lead to a range of negative consequences, including unauthorized access to sensitive data, system compromise, and potential disruption of services. The specific impact depends on the affected product and the attacker’s objectives. If successfully exploited across a large number of systems, the vulnerability could result in significant financial losses and reputational damage.

Recommendation

• Identify the specific Microsoft product affected by CVE-2017-3735 by consulting the Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-3735).
• Apply the appropriate security patches or updates provided by Microsoft for the affected product to remediate CVE-2017-3735.
• Monitor network traffic for suspicious activity related to exploitation attempts targeting CVE-2017-3735 using a network intrusion detection system (NIDS). Deploy the network connection rule below for initial recon activity.
• Implement the process creation rule below to look for unexpected child processes spawned after applying the patch to identify potential bypass attempts.