CVE-2022-31199

What it actually does

CVE-2022-31199 is an unauthenticated remote code execution flaw in the protocol used by the Netwrix Auditor User Activity Video Recording component. A remote attacker who can reach the affected Netwrix Auditor server or an affected agent on a monitored Windows system can send crafted protocol data that triggers unsafe deserialization and causes attacker-controlled code to execute as NT AUTHORITY\SYSTEM. Because the vulnerable component can run on both the central Auditor server and monitored endpoints, exploitation can directly compromise high-privilege Windows hosts and provide full confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an attacker complete control of the Netwrix Auditor server or monitored Windows systems, allowing theft of sensitive audit data, credential harvesting, tampering with monitoring evidence, deployment of ransomware, and lateral movement across the environment. The issue is in the CISA Known Exploited Vulnerabilities catalog, is marked as used in ransomware campaigns, and has active exploitation in the wild, so exposed or unpatched deployments should be treated as urgent even though the vulnerability is older.

How an attack unfolds

An attacker first identifies Netwrix Auditor servers or agents with the User Activity Video Recording component reachable over the network. The attacker then connects to the component’s underlying service/protocol endpoint and sends a specially crafted serialized payload. Because the service deserializes attacker-controlled data unsafely, the payload results in execution of arbitrary commands in the security context of the Netwrix service, which may be NT AUTHORITY\SYSTEM. From there, the attacker can run reconnaissance commands, create or modify local users, dump credentials, disable security tools, deploy remote access tooling, tamper with audit collection, move laterally from a monitored host, or stage ransomware. Since exploitation does not require authentication or user interaction, internet-facing, broadly reachable, or flat-network deployments are at highest risk.

How to fix it

Upgrade Netwrix Auditor servers and all deployed Netwrix Auditor agents to a vendor-supported version that includes the fix for CVE-2022-31199. Because fixed versions were not provided in the input, confirm the exact corrected release from Netwrix advisories and ensure both the central server and monitored-system agents are updated; patching only the server may leave agents exploitable. If immediate upgrade is not possible, disable the User Activity Video Recording component where it is not business-critical, restrict network access to Netwrix Auditor and agent service ports to only required management systems, block inbound access from untrusted networks, and isolate affected systems until patched. Rotate credentials and service account secrets that may have been exposed from compromised Netwrix infrastructure, especially where exploitation is suspected.

How to confirm the fix worked

Confirm the installed Netwrix Auditor server and agent versions are at or above the vendor-fixed release and that no affected agents remain deployed on monitored systems. Validate that the User Activity Video Recording component is either patched or disabled, and verify host firewalls and network ACLs prevent untrusted systems from reaching Netwrix service endpoints. Perform an authenticated software inventory for Netwrix Auditor installations across servers and endpoints, not just the central management server. After remediation, review Windows Service Control Manager, process creation, PowerShell, scheduled task, and endpoint security telemetry for suspicious activity occurring before the patch date, because successful exploitation may leave persistence behind even after the vulnerability is fixed.

Typical attack path

1. Scan for Netwrix Auditor servers or monitored systems exposing the User Activity Video Recording component or related service ports.
2. Confirm the target is running an affected Netwrix Auditor server or agent version.
3. Send a crafted serialized/protocol payload to the vulnerable component without authenticating.
4. Achieve command execution as the Netwrix service account, potentially NT AUTHORITY\SYSTEM.
5. Run Windows discovery commands and enumerate domain, host, security tooling, and credentials.
6. Install persistence or remote access tooling, create services or scheduled tasks, and attempt credential theft.
7. Use the compromised Netwrix server or monitored endpoint for lateral movement because it may have privileged visibility and access across monitored assets.
8. Exfiltrate data, tamper with audit evidence, or deploy ransomware.

How to detect it

To determine whether exploitation already occurred, review telemetry from Netwrix Auditor servers and monitored systems running the Netwrix Auditor agent. Prioritize Windows Security event logs with process creation enabled, Sysmon, PowerShell logs, Windows Defender or EDR telemetry, Service Control Manager logs, scheduled task logs, Netwrix application/service logs, and network flow data to Netwrix service ports. Look for Netwrix service processes spawning command interpreters, scripting engines, download utilities, credential-dumping tools, or archive utilities. Investigate SYSTEM-level process creation shortly after inbound connections to Netwrix Auditor or User Activity Video Recording service endpoints. Also search for new or modified services, scheduled tasks, local users, local administrator group changes, LSASS access, disabled security tools, unexpected outbound connections, and ransomware staging activity. Because this vulnerability has been used in ransomware campaigns, correlate suspicious Netwrix activity with lateral movement events such as remote service creation, SMB admin share access, WinRM, RDP logons, PsExec-style execution, and domain reconnaissance commands.

• Netwrix Auditor User Activity Video Recording
• NT AUTHORITY\SYSTEM
• C:\Program Files\Netwrix Auditor\
• C:\Program Files (x86)\Netwrix Auditor\
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• powershell.exe -nop
• powershell.exe -w hidden
• pwsh.exe -EncodedCommand
• certutil.exe -urlcache -split -f
• bitsadmin.exe /transfer
• rundll32.exe javascript:
• mshta.exe http
• mshta.exe https
• wmic.exe process call create
• schtasks.exe /create
• sc.exe create
• net user /add
• net localgroup administrators
• vssadmin.exe delete shadows
• wbadmin.exe delete catalog
• bcdedit.exe /set {default} recoveryenabled no
• wevtutil.exe cl Security
• wevtutil.exe cl System
• wevtutil.exe cl Application
• taskkill.exe /f /im MsMpEng.exe
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump

What your security team should do

• Treat this as a high-priority incident-response and patching item because it is in the CISA KEV catalog, has active exploitation, and is associated with ransomware activity.
• Identify every Netwrix Auditor server and every monitored system running a Netwrix Auditor agent, then verify the User Activity Video Recording component status and software version.
• Patch or upgrade all affected Netwrix Auditor components; if patching cannot be completed quickly, disable the vulnerable component and restrict service reachability at host and network firewalls.
• Hunt for exploitation across Netwrix servers and monitored hosts, focusing on suspicious child processes spawned by Netwrix services and SYSTEM-level command execution.
• Review privileged account use, service account credentials, and secrets accessible from Netwrix systems; rotate credentials if compromise cannot be ruled out.
• Check for persistence mechanisms such as new Windows services, scheduled tasks, startup-folder items, WMI event subscriptions, and unauthorized local administrators created after potential exposure.
• Increase monitoring on Netwrix infrastructure because compromise of audit tooling can allow attackers to blind or tamper with security and compliance evidence.
• If indicators of exploitation are found, isolate affected hosts, collect forensic images or triage data, and conduct a broader ransomware/lateral-movement investigation.