CVE-2023-24880

What it actually does

CVE-2023-24880 is a Windows SmartScreen security feature bypass. A locally executed, specially crafted file can evade SmartScreen reputation and Mark-of-the-Web-related warning flows that normally alert users or impose additional restrictions on content downloaded from the Internet. Exploitation does not directly grant code execution by itself; it lowers a key user-protection barrier so malicious files are more likely to run without expected warnings, enabling follow-on malware execution, persistence, credential theft, or ransomware deployment.

Why it matters to the business

The main business risk is that users may open Internet-delivered malware without receiving the normal Windows safety warning, increasing the likelihood of successful phishing, malware infection, and ransomware incidents. This vulnerability is listed in CISA KEV, has been observed exploited in the wild, is associated with ransomware activity, and has a high EPSS probability, so unpatched Windows endpoints and servers should be treated as high-priority exposure even though the CVSS score is moderate. The CISA remediation deadline of 2023-04-04 has long passed, making continued exposure a governance and operational risk.

How an attack unfolds

An attacker prepares a malicious file designed to bypass Windows SmartScreen checks, commonly delivered through phishing, malvertising, compromised websites, or archive/download lures. The target user downloads the file from the Internet and opens it. Because the file is crafted to evade the SmartScreen security prompt or associated Mark-of-the-Web handling, the user may not see the expected warning that the file is untrusted. The malicious payload then executes with the user’s privileges. From there, the attacker typically runs a downloader, installer, script, or embedded payload, establishes persistence, contacts command-and-control infrastructure, and may deploy ransomware or other post-compromise tooling.

How to fix it

Apply the Microsoft security updates released for CVE-2023-24880, including the March 2023 cumulative updates or later cumulative updates for all affected Windows versions. Ensure Windows 10 1607, 1809, 20H2, 21H2, 22H2; Windows 11 21H2 and 22H2; Windows Server 2016, 2019, and 2022 are fully patched. Where systems are out of support or cannot receive current cumulative updates, upgrade to a supported Windows release or isolate and restrict those systems until patched. Keep Microsoft Defender SmartScreen enabled, enforce endpoint protection controls, block execution from user-writable download locations where practical, restrict script and installer execution using application control, and educate users to avoid opening unexpected downloaded files. Because this CVE is in CISA KEV and associated with ransomware campaigns, compensating controls should not be considered a long-term substitute for patching.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative update that includes the March 2023 CVE-2023-24880 fix or any later cumulative update. Validate through Windows Update, WSUS, Microsoft Endpoint Configuration Manager, Intune, vulnerability scanners, or authenticated patch inventory. Test exposure by verifying that Internet-downloaded test files retain Mark-of-the-Web metadata and that SmartScreen protections remain enabled; do not use live malware for validation. Review Group Policy, MDM, and registry configuration to ensure SmartScreen has not been disabled. Validate that endpoint telemetry records file creation, alternate data streams, process creation, and network-origin download events so future exploitation attempts can be investigated.

Typical attack path

1. Attacker crafts or packages a malicious Windows file to bypass SmartScreen warning behavior.
2. Attacker delivers the file through phishing email, malicious links, compromised websites, malvertising, or file-sharing lures.
3. User downloads the file to a Windows 10, Windows 11, or Windows Server system.
4. User opens the file, satisfying the required user interaction condition.
5. SmartScreen or Mark-of-the-Web-based warning protections are bypassed or not presented as expected.
6. Malicious code runs with the privileges of the logged-in user.
7. Payload downloads or launches additional malware, scripts, or installers.
8. Attacker establishes persistence, performs discovery, steals credentials, moves laterally, or deploys ransomware.

How to detect it

To determine whether this was already exploited, focus on evidence of Internet-origin files being executed before systems were patched. Useful sources include EDR process telemetry, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 15 file stream creation for Mark-of-the-Web alternate data streams, Windows Security logs, PowerShell logs, Microsoft Defender Antivirus and Defender for Endpoint alerts, SmartScreen-related logs where enabled, browser download history, email security logs, proxy logs, and web gateway logs. Hunt for files downloaded from the Internet to user-writable paths and then executed shortly afterward, especially MSI, EXE, LNK, ISO, IMG, ZIP-contained executables, JS, VBS, WSF, HTA, BAT, CMD, or PowerShell payloads. Pay particular attention to execution by msiexec.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, powershell.exe, pwsh.exe, cmd.exe, explorer.exe, or archive utilities launching child processes from Downloads, Desktop, Temp, browser cache, or email attachment locations. Look for absence of expected SmartScreen prompts around suspicious downloaded-file execution, but do not rely on SmartScreen logs alone because bypass activity may leave limited direct evidence. Because ransomware exploitation has been reported, expand investigations to include persistence mechanisms, scheduled tasks, Run keys, suspicious services, credential dumping tools, lateral movement, backup deletion, and shadow copy deletion.

• Zone.Identifier
• ZoneId=3
• Microsoft-Windows-SmartScreen
• SmartScreen
• \Downloads\
• \Desktop\
• \AppData\Local\Temp\
• \AppData\Local\Microsoft\Windows\INetCache\
• \AppData\Local\Microsoft\Windows\Temporary Internet Files\
• msiexec.exe
• rundll32.exe
• regsvr32.exe
• wscript.exe
• cscript.exe
• powershell.exe
• pwsh.exe
• mshta.exe
• cmd.exe /c
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled no
• schtasks.exe /Create
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Immediately patch all affected Windows endpoints and servers with March 2023 or later cumulative updates; prioritize internet-facing, user-facing, VDI, kiosk, and high-risk employee workstations.
• Treat unpatched systems as high-risk because the vulnerability is in CISA KEV, has active exploitation, has high EPSS, and is associated with ransomware use.
• Hunt for recent execution of downloaded files from user-writable locations such as Downloads, Desktop, Temp, browser cache, and email attachment directories.
• Correlate browser, email gateway, EDR, Sysmon, and Windows event telemetry for download-to-execution chains involving MSI, EXE, LNK, ISO, IMG, ZIP, JS, VBS, WSF, HTA, or script payloads.
• Ensure Microsoft Defender SmartScreen, Microsoft Defender Antivirus, cloud-delivered protection, and attack surface reduction rules are enabled where supported.
• Deploy or tighten application control policies such as WDAC or AppLocker to restrict unsigned or untrusted executables, scripts, and installers launched from user profile paths.
• Block or warn on high-risk attachment types and archive-contained executables at email and web gateways.
• Investigate any endpoint that executed suspicious downloaded content prior to patching for persistence, credential theft, lateral movement, and ransomware staging.
• Monitor for ransomware precursor behaviors such as mass file discovery, backup deletion, shadow copy deletion, credential dumping, and remote execution tooling.