c-g-creator/letsdefend-soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298LetsDefend SOC336 case study on CVE-2025-21298
This repository documents my investigation of a LetsDefend alert involving a Windows OLE zero-click remote code execution exploit tied to CVE-2025-21298. The goal is to show the reasoning behind the conclusion, from email triage to endpoint containment.
LetsDefend generated the alert after detecting a malicious RTF attachment in an incoming email sent to [email protected]. The message came from projectmanagement@pm[.]me with the subject Important: Action Required for Upcoming Project Deadline. I reviewed the email, attachment, sender details, and endpoint activity to determine whether the alert was a true positive.
writeup/SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298.md — full case study.screenshots/ — evidence images used in the write-up.The activity was consistent with a true positive exploit attempt. The malicious RTF attachment, sender details, sender IP, and endpoint process behavior all pointed to a successful delivery chain with suspicious post-delivery activity.
Open the write-up first, then review the screenshots in order. The markdown file is written so it can stand on its own inside GitHub without extra context.
This repo is written in a natural, straightforward style so it reads like an actual SOC case study.