Hackers exploit Windows XSS flaw for MMC console arbitrary commands

TLDR:

• Attackers are using a Windows XSS flaw to execute arbitrary commands in the MMC console.
• This new infection technique, dubbed “GrimResource,” uses MSC files to run code inside mmc.exe.

Security researchers have identified a new malware delivery mechanism called “GrimResource” that exploits an XSS vulnerability in the apds.dll library to execute arbitrary JavaScript within mmc.exe when opening specially crafted MSC files. This technique involves DotNetToJScript and a custom loader called PASTALOADER to retrieve payloads and inject them into new instances of dllhost.exe. The final payload, Cobalt Strike, highlights the sophistication of this attack vector. Various detection methods, including monitoring for suspicious execution behaviors and observing script execution in the MMC Console, have been recommended to detect this technique. Implementing proactive security measures is crucial to defend against evolving cyber threats like GrimResource.

Security experts recommend defenders implement practical detection guidance against this technique before it’s adopted by most threat actors targeting the commodity market. Consequently, this highlights the need for proactive security measures in response to ever-changing cyber threats.