Coverage › CVE-2024-38112

CVE-2024-38112 Mapped Sigma

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Vendor / product: Microsoft — Windows
Description (CISA): Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.
Added to KEV: 2024-07-09
Due date: 2024-07-30
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: CWE-451
CISA notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112
https://nvd.nist.gov/vuln/detail/CVE-2024-38112
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1189 Drive-by Compromise	exploitation technique	This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system. ref 1	live
T1204.001 Malicious Link	exploitation technique	This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1189 Drive-by Compromise exploitation technique

DET0176 Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)
AN0498 Windows
Correlated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops. Defender sees network requests to previously unseen/suspicious domains or resources + browser process spawning unusual children or loading unsigned modules + file writes or registry changes shortly after those requests.

WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Application Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events → DC0038 Application Log Content
etw:Microsoft-Windows-Kernel-Process Memory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process → DC0020 Process Modification
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
NSM:Flow http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources → DC0085 Network Traffic Content

Tunable: TimeWindow KnownGoodDomainsList PayloadEntropyThreshold UserContext

AN0499 Linux
Correlated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.

auditd:SYSCALL execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget) → DC0032 Process Creation
linux:syslog Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads → DC0038 Application Log Content
NSM:Flow http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains → DC0085 Network Traffic Content
linux:Sysmon New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch → DC0039 File Creation
NSM:Connections Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports → DC0082 Network Connection Creation

Tunable: TempPathPatterns UserShellWhitelist DomainRarityThreshold

AN0500 macOS
Correlated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes. Defender sees: proxy/HTTP logs with suspicious resource content + unifiedlogs/ASL showing browser/plugin crashes or extension loads + process events indicating child process creation and file writes to /var/folders or /tmp shortly after the fetch.

macos:unifiedlog Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches → DC0038 Application Log Content
macos:unifiedlog process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary → DC0032 Process Creation
macos:unifiedlog New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children → DC0039 File Creation
NSM:Flow HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects) → DC0085 Network Traffic Content
macos:unifiedlog Anomalous dyld dynamic library loads or RWX memory mappings in browser process → DC0020 Process Modification

Tunable: SleepyUserThreshold ExtensionInstallPolicy

AN0501 Identity Provider
Post-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes. Defender sees an endpoint/browser compromise (network + endpoint signals) followed by unusual IdP events: new refresh token issuance, consent/consent-grant events, odd MFA bypass patterns, or unusual OAuth client registrations.

azure:signinlogs SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times → DC0002 User Account Authentication
m365:unified Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise → DC0038 Application Log Content
saas:auth Refresh token issuance or refresh token usage from new IPs or user agents → DC0013 User Account Metadata
AWS:CloudTrail ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise → DC0067 Logon Session Creation

Tunable: IdpAlertWindow HighRiskCountryList DeviceTrustLevel

Sigma rules tagged `attack.t1189` (3)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Flash Player Update from Suspicious Location hightest

Author: Florian Roth (Nextron Systems) · 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997

Detects a flashplayer update from an unofficial location

Techniques: T1189 T1204.002 T1036.005

Cross Site Scripting Strings hightest

Author: Saw Win Naung, Nasreddine Bencherchali · 2021-08-15 (modified 2022-06-14) · logsource: category=webserver · 65354b83-a2ea-4ea6-8414-3ab38be0d409

Detects XSS attempts injected via GET requests in access logs

Techniques: T1189

T1204.001 Malicious Link exploitation technique

DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
AN0178 Windows
Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
NSM:Flow Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST → DC0085 Network Traffic Content

Tunable: TimeWindow BrowserParents UserPaths SuspiciousTLDs AllowedCDNs

AN0179 Linux
Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.

auditd:SYSCALL execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline → DC0082 Network Connection Creation
auditd:SYSCALL open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions → DC0039 File Creation
NSM:Flow Suspicious URL patterns, uncommon TLDs, URL shorteners → DC0085 Network Traffic Content

Tunable: TimeWindow UserPaths HighRiskExtensions DomainRiskScore

AN0180 macOS
Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.

macos:unifiedlog open URL|clicked link|LSQuarantineAttach → DC0085 Network Traffic Content
NSM:Connections New outbound connection from Safari/Chrome/Firefox/Word → DC0082 Network Connection Creation
fs:fsevents Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute → DC0039 File Creation

Tunable: TimeWindow QuarantinePolicy SuspiciousTLDs

Sigma rules tagged `attack.t1204.001` (4)

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

Symlink Etc Passwd hightest

Author: Florian Roth (Nextron Systems) · 2019-04-05 (modified 2021-11-27) · logsource: product=linux · c67fc22a-0be5-4b4f-aad5-2b32c4b69523

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Techniques: T1204.001

Suspicious ClickFix/FileFix Execution Pattern highexperimental

Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

Techniques: T1204.001 T1204.004

Potential ClickFix Execution Pattern - Registry highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-03-25 (modified 2025-11-19) · logsource: product=windows category=registry_set · f5fe36cf-f1ec-4c23-903d-09a3110f6bbb

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.