msrc.microsoft.com Open in urlscan Pro
2620:1ec:bdf::45  Public Scan

Form analysis
0 forms found in the DOM

Text Content

You need to enable JavaScript to run this app.
Skip to contentMicrosoft
MSRC
Security Updates
Acknowledgements
Developer

Feedback and support

Sign in to your account
Sign in


Looking for email notifications? Please create your profile with your preferred
email address to sign up for notifications. See our blog post for more
information .

Go to profile to subscribeHide for nowDon't show again
 1. MSRC
    MSRC
    
 2. Customer Guidance
    Customer Guidance
    
 3. Security Update Guide
    Security Update Guide
    
 4. Vulnerabilities
    Vulnerabilities
    
 5. ADV 230001
    ADV 230001


GUIDANCE ON MICROSOFT SIGNED DRIVERS BEING USED MALICIOUSLY

On this page
ADV230001Security Advisory

Released: Jul 11, 2023

Assigning CNA:

This CVE was issued by Microsoft
Microsoft

Impact: Defense in Depth

Max Severity: None


EXECUTIVE SUMMARY:

Microsoft was recently informed that drivers certified by Microsoft’s Windows
Hardware Developer Program (MWHDP) were being used maliciously in
post-exploitation activity. In these attacks, the attacker gained administrative
privileges on compromised systems before using the drivers.

Microsoft has completed its investigation and determined that the activity was
limited to the abuse of several developer program accounts and that no Microsoft
account compromise has been identified. We’ve suspended the partners' seller
accounts and implemented blocking detections for all the reported malicious
drivers to help protect customers from this threat.

Details:

Microsoft was informed that drivers certified by Microsoft’s Windows Hardware
Developer Program were being used maliciously in post-exploitation activity. In
these attacks, the attacker had already gained administrative privileges on
compromised systems prior to use of the drivers. An investigation was performed
when we were notified of this activity by Sophos on February 9, 2023; Trend
Micro and Cisco subsequently provided reports containing additional details.
This investigation revealed that several developer accounts for the Microsoft
Partner Center (MPC) were engaged in submitting malicious drivers to obtain a
Microsoft signature. All the developer accounts involved in this incident were
immediately suspended.

Microsoft has released Window Security updates (see Security Updates table) that
untrust drivers and driver signing certificates for the impacted files and has
suspended the partners' seller accounts. Additionally, Microsoft has implemented
blocking detections (Microsoft Defender 1.391.3822.0 and newer) to help protect
customers from legitimately signed drivers that have been used maliciously in
post-exploit activity. For more information about how the Windows Code Integrity
feature protects Microsoft customers from revoked certificates see: (Notice of
additions to the Windows Driver.STL revocation list - Microsoft
Support)[https://support.microsoft.com/help/5029033].

Microsoft is working with Microsoft Active Protections Program (MAPP) partners
to help develop further detections and to better protect our shared customers.
Microsoft Partner Center is also working on long-term solutions to address these
deceptive practices and prevent future customer impacts.


RECOMMENDED ACTIONS:

Microsoft recommends that all customers install the latest Windows updates and
ensure their anti-virus and endpoint detection products are up to date with the
latest signatures and are enabled to prevent these attacks.


FREQUENTLY ASKED QUESTIONS:

Are any Microsoft services (Azure, M365, XBOX, Etc.) affected by this issue?

Microsoft’s services are not affected by this issue. Our investigation has
not identified any instances of malicious drivers affecting any of our services.

How can customers deploy their own Hypervisor-protected Code
Integrity (HVCI) policy to perform detections in their own environment?

Updates will be made to the Microsoft Recommended Driver Blocklist - Microsoft
recommended driver block rules (Windows 10) - Windows security | Microsoft
Docs policy to perform detections in their own environment.

After the full set of malicious files has been locked, customers (enterprise and
consumer) can deploy this policy onto devices to block against this malicious
file and other malicious and vulnerable drivers on the blocklist. Additionally,
enabling Hypervisor-protected Code Integrity (HVCI) will automatically enforce
the policy without needing to deploy the policy.

How do I determine if any drivers are affected that were installed prior to the
available detections were implemented?

Offline scans will be required to detect malicious drivers which might have been
installed prior to March 2, 2023, when new Microsoft detections were
implemented. For more information see Remove malware from your Windows PC.


EXPLOITABILITY

The following table provides an exploitability assessment for this vulnerability
at the time of original publication.
Publicly Disclosed

Exploited

Latest Software Release

No
Yes
Exploitation Detected


ACKNOWLEDGEMENTS

 * Sophos X-Ops teams
 * Chris Neal of Cisco Talos
 * Trend Micro Research

Microsoft recognizes the efforts of those in the security community who help us
protect customers through coordinated vulnerability disclosure. See
Acknowledgements for more information.


SECURITY UPDATES

To determine the support lifecycle for your software, see the Microsoft Support
Lifecycle.
Updates CVSS
Release date Descending
Edit columns
Download

Clear
Release Date

Product

Platform

Impact

Max Severity

Article

Download

Build Number

Details

Jul 11, 2023
Windows Server 2012 R2 (Server Core installation)
-
Defense in Depth
None
 * 5028228 
 * 5028223 

 * Monthly Rollup 
 * Security Only 

 * 6.3.9600.21063
 * 6.3.9600.21075

ADV230001
Jul 11, 2023
Windows Server 2012 R2
-
Defense in Depth
None
 * 5028228 
 * 5028223 

 * Monthly Rollup 
 * Security Only 

 * 6.3.9600.21063
 * 6.3.9600.21075

ADV230001
Jul 11, 2023
Windows Server 2012 (Server Core installation)
-
Defense in Depth
None
 * 5028232 
 * 5028233 

 * Monthly Rollup 
 * Security Only 

 * 6.2.9200.24374
 * 6.2.9200.24374

ADV230001
Jul 11, 2023
Windows Server 2012
-
Defense in Depth
None
 * 5028232 
 * 5028233 

 * Monthly Rollup 
 * Security Only 

 * 6.2.9200.24374
 * 6.2.9200.24374

ADV230001
Jul 11, 2023
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)
-
Defense in Depth
None
 * 5028240 
 * 5028224 

 * Monthly Rollup 
 * Security Only 

 * 6.1.7601.26623
 * 6.1.7601.26623

ADV230001
Jul 11, 2023
Windows Server 2008 R2 for x64-based Systems Service Pack 1
-
Defense in Depth
None
 * 5028240 
 * 5028224 

 * Monthly Rollup 
 * Security Only 

 * 6.1.7601.26623
 * 6.1.7601.26623

ADV230001
Jul 11, 2023
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)
-
Defense in Depth
None
 * 5028222 
 * 5028226 

 * Monthly Rollup 
 * Security Only 

 * 6.0.6003.22175
 * 6.0.6003.22175

ADV230001
Jul 11, 2023
Windows Server 2008 for x64-based Systems Service Pack 2
-
Defense in Depth
None
 * 5028222 
 * 5028226 

 * Monthly Rollup 
 * Security Only 

 * 6.0.6003.22175
 * 6.0.6003.22175

ADV230001
Jul 11, 2023
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
-
Defense in Depth
None
 * 5028222 
 * 5028226 

 * Monthly Rollup 
 * Security Only 

 * 6.0.6003.22175
 * 6.0.6003.22175

ADV230001
Jul 11, 2023
Windows Server 2008 for 32-bit Systems Service Pack 2
-
Defense in Depth
None
 * 5028222 
 * 5028226 

 * Monthly Rollup 
 * Security Only 

 * 6.0.6003.22175
 * 6.0.6003.22175

ADV230001
Jul 11, 2023
Windows Server 2016 (Server Core installation)
-
Defense in Depth
None
 * 5028169 

 * Security Update 

 * 10.0.14393.6085

ADV230001
Jul 11, 2023
Windows Server 2016
-
Defense in Depth
None
 * 5028169 

 * Security Update 

 * 10.0.14393.6085

ADV230001
Jul 11, 2023
Windows 10 Version 1607 for x64-based Systems
-
Defense in Depth
None
 * 5028169 

 * Security Update 

 * 10.0.14393.6085

ADV230001
Jul 11, 2023
Windows 10 Version 1607 for 32-bit Systems
-
Defense in Depth
None
 * 5028169 

 * Security Update 

 * 10.0.14393.6085

ADV230001
Jul 11, 2023
Windows 10 for x64-based Systems
-
Defense in Depth
None
 * 5028186 

 * Security Update 

 * 10.0.10240.20048

ADV230001
Jul 11, 2023
Windows 10 for 32-bit Systems
-
Defense in Depth
None
 * 5028186 

 * Security Update 

 * 10.0.10240.20048

ADV230001
Jul 11, 2023
Windows 10 Version 22H2 for 32-bit Systems
-
Defense in Depth
None
 * 5028166 

 * Security Update 

 * 10.0.19045.3208

ADV230001
Jul 11, 2023
Windows 10 Version 22H2 for ARM64-based Systems
-
Defense in Depth
None
 * 5028166 

 * Security Update 

 * 10.0.19045.3208

ADV230001
Jul 11, 2023
Windows 10 Version 22H2 for x64-based Systems
-
Defense in Depth
None
 * 5028166 

 * Security Update 

 * 10.0.19045.3208

ADV230001
Jul 11, 2023
Windows 11 Version 22H2 for x64-based Systems
-
Defense in Depth
None
 * 5028185 

 * Security Update 

 * 10.0.22621.1992

ADV230001
Jul 11, 2023
Windows 11 Version 22H2 for ARM64-based Systems
-
Defense in Depth
None
 * 5028185 

 * Security Update 

 * 10.0.22621.1992

ADV230001
Jul 11, 2023
Windows 10 Version 21H2 for x64-based Systems
-
Defense in Depth
None
 * 5028166 

 * Security Update 

 * 10.0.19041.3208

ADV230001
Jul 11, 2023
Windows 10 Version 21H2 for ARM64-based Systems
-
Defense in Depth
None
 * 5028166 

 * Security Update 

 * 10.0.19041.3208

ADV230001
Jul 11, 2023
Windows 10 Version 21H2 for 32-bit Systems
-
Defense in Depth
None
 * 5028166 

 * Security Update 

 * 10.0.19041.3208

ADV230001
Jul 11, 2023
Windows 11 version 21H2 for ARM64-based Systems
-
Defense in Depth
None
 * 5028182 

 * Security Update 

 * 10.0.22000.2176

ADV230001
Jul 11, 2023
Windows 11 version 21H2 for x64-based Systems
-
Defense in Depth
None
 * 5028182 

 * Security Update 

 * 10.0.22000.2176

ADV230001
Jul 11, 2023
Windows Server 2022 (Server Core installation)
-
Defense in Depth
None
 * 5028171 

 * Security Update 

 * 10.0.20348.1850

ADV230001
Jul 11, 2023
Windows Server 2022
-
Defense in Depth
None
 * 5028171 

 * Security Update 

 * 10.0.20348.1850

ADV230001
Jul 11, 2023
Windows Server 2019 (Server Core installation)
-
Defense in Depth
None
 * 5028168 

 * Security Update 

 * 10.0.17763.4645

ADV230001
Jul 11, 2023
Windows Server 2019
-
Defense in Depth
None
 * 5028168 

 * Security Update 

 * 10.0.17763.4645

ADV230001
Jul 11, 2023
Windows 10 Version 1809 for ARM64-based Systems
-
Defense in Depth
None
 * 5028168 

 * Security Update 

 * 10.0.17763.4645

ADV230001
Jul 11, 2023
Windows 10 Version 1809 for x64-based Systems
-
Defense in Depth
None
 * 5028168 

 * Security Update 

 * 10.0.17763.4645

ADV230001
Jul 11, 2023
Windows 10 Version 1809 for 32-bit Systems
-
Defense in Depth
None
 * 5028168 

 * Security Update 

 * 10.0.17763.4645

ADV230001

All results loaded
Loaded all 33 rows


DISCLAIMER

The information provided in the Microsoft Knowledge Base is provided "as is"
without warranty of any kind. Microsoft disclaims all warranties, either express
or implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Microsoft Corporation or its suppliers be
liable for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if Microsoft
Corporation or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply.


REVISIONS

version

revisionDate

description

1.0
Jul 11, 2023

Information published.


How satisfied are you with the MSRC Security Update Guide?

Not satisfied12345Very satisfied