[[ fm.text ]] Click here

Renderer spawns LOLBin with high-confidence malicious CLI (CVE-2025-50165)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Renderer spawns LOLBin with explicit evasion or remote-execution CLI (encoded PS, IEX, mshta URL). High-confidence CVE-2025-50165 exploitation signal.

title: Renderer spawns LOLBin with high-confidence malicious CLI (CVE-2025-50165)
id: 8d8b3a25-6a34-4c8c-9a36-2b0e5f0c1f6c
status: experimental
description: |
  Renderer spawns LOLBin with explicit evasion or remote-execution CLI (encoded PS, IEX, mshta URL). High-confidence CVE-2025-50165 exploitation signal. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte un contexte de rendu (Office, PDF, Photos) lançant un LOLBin avec des indicateurs CLI de haute confiance : PowerShell encodé avec flags d'évasion, IEX, téléchargement distant, squiblydoo regsvr32, mshta URL. Signal fort d'exploitation CVE-2025-50165. Combinaison parent renderer + LOLBin + évasion CLI est rare en usage légitime. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: 0f2b9c8a-3f2b-4f5b-a4e1-8f9c6d1a2b33
    type: similar

references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-50165
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50165
  - https://www.zscaler.com/blogs/security-research/cve-2025-50165-critical-flaw-windows-graphics-component

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2025-12-18
modified: 2026-06-21

tags:
  - attack.initial-access
  - attack.execution
  - attack.t1203
  - attack.t1059
  - cve.2025-50165

logsource:
  product: windows
  category: process_creation

detection:
  selection_parent_renderers:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\dllhost.exe'
      - '\prevhost.exe'
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\msaccess.exe'
      - '\onenote.exe'
      - '\acrord32.exe'
      - '\acrobat.exe'
      - '\sumatrapdf.exe'
      - '\foxitpdfreader.exe'
      - '\pdfxcview.exe'
      - '\microsoft.photos.exe'

  selection_lolbin_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\schtasks.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\wmic.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\forfiles.exe'
      - '\pcalua.exe'
      - '\odbcconf.exe'
      - '\ieexec.exe'
      - '\xwizard.exe'

  # High-confidence CLI patterns: each entry alone is sufficient to be suspicious in a renderer context
  # Split into two OR-joined groups: evasion flags and explicit execution/download indicators
  # An attacker using ONLY evasion flags (no download) still triggers via selection_exec_cli OR
  # An attacker using ONLY a download verb (no -nop) still triggers via selection_exec_cli alone
  selection_evasion_cli:
    CommandLine|contains:
      - ' -nop '
      - ' -noprofile '
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' -NonInteractive'
      - ' -sta '

  selection_exec_cli:
    CommandLine|contains:
      - ' -enc '
      - ' -encodedcommand '
      - '-ec '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'Invoke-WebRequest'
      - 'New-Object Net.WebClient'
      - 'mshta http'
      - 'mshta https'
      - 'regsvr32 /s /n /u /i:'
      - 'rundll32 javascript:'
      - 'scrobj.dll'
      - '/e:jscript'
      - '/e:vbscript'
      - 'certutil -urlcache'
      - 'bitsadmin /transfer'
      - 'Start-BitsTransfer'
      - 'DownloadFile('

  filter_main_office_automation:
    ParentCommandLine|contains:
      - '/automation'
      - '/embedding'
      - '/pt '

  # Angle mort corrigé : la condition précédente (AND entre evasion_cli et exec_cli) laissait
  # passer les stagers n'utilisant qu'un seul des deux blocs. La nouvelle condition utilise OR
  # entre les deux blocs, ce qui couvre les deux scénarios séparément.
  condition: selection_parent_renderers and selection_lolbin_child and (selection_evasion_cli or selection_exec_cli) and not filter_main_office_automation

fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Rare enterprise IT scripts using PowerShell with encoded commands launched via Office automation; validate against baseline and tune by signer or image path
  - Legitimate admin automation via Office macros is uncommon; document and allowlist by CommandLine pattern if confirmed benign

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

632e7048-a233-4a50-bd63-b4f1cefa1dc6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion