CVE-2024-21412

What it actually does

CVE-2024-21412 is a Windows Internet Shortcut (.url) security feature bypass that can cause Windows security protections such as Mark-of-the-Web and Microsoft Defender SmartScreen warnings to be bypassed when a user opens a specially crafted Internet Shortcut file. The vulnerability does not by itself provide code execution without user interaction, but it can remove or suppress the normal trust boundary prompts that warn users before opening content from the Internet. In practical attacks, this enables phishing-delivered shortcut files to launch or retrieve remote malicious content with fewer warnings, supporting credential theft, malware delivery, or follow-on execution through trusted Windows handlers such as Explorer, WebDAV/SMB access, scripting engines, or LOLBins.

Why it matters to the business

Successful exploitation increases the likelihood that users will open malicious files because Windows may not display the expected Internet-origin warning. This can lead to malware infection, credential theft, ransomware staging, and data compromise on Windows endpoints and servers where users interact with downloaded or emailed files. The risk is high because exploitation is confirmed in the wild, the EPSS score is very high, it is listed in CISA KEV with a remediation deadline of 2024-03-05, and it has been associated with ransomware activity. Organizations with broad Windows desktop or terminal-server exposure should treat unpatched systems as priority remediation targets.

How an attack unfolds

An attacker typically starts with social engineering, delivering a crafted Internet Shortcut file through email, instant messaging, a compromised website, archive attachment, or a shared file location. The shortcut is constructed so that when the user opens it, Windows processes the .url file in a way that bypasses normal Internet-origin safety prompts. The shortcut may point to attacker-controlled infrastructure over HTTP, WebDAV, or SMB, or may trigger a trusted Windows component to retrieve or launch additional content. Because the expected SmartScreen or Mark-of-the-Web warning may be bypassed, the user is less likely to abandon the action. The attacker then uses the launched payload or remote content to establish execution, steal credentials or tokens, download malware, persist, move laterally, and in ransomware campaigns, stage encryption tooling or data theft operations.

How to fix it

Apply the Microsoft security update that addresses CVE-2024-21412 for all affected Windows versions, including Windows 10 1809/21H2/22H2, Windows 11 21H2/22H2/23H2, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2. If exact fixed build numbers are not tracked internally, use the Microsoft Security Update Guide and install the February 2024 cumulative update or any later cumulative update for the applicable OS release. Prioritize internet-facing management endpoints, user workstations, VDI, jump hosts, terminal servers, and systems used to process email or downloaded files. Where immediate patching is not possible, reduce exposure by blocking or quarantining .url files from email and web downloads, inspecting archives that contain shortcut files, restricting outbound SMB/WebDAV to the Internet, blocking outbound TCP 445/139 except to approved destinations, enabling Microsoft Defender SmartScreen and Attack Surface Reduction rules, and monitoring or restricting script interpreters and LOLBins launched from Explorer or shortcut interactions.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative update that includes the February 2024 fix or a later cumulative update. Validate using enterprise patch inventory, Windows Update history, Microsoft Update Compliance, endpoint management tooling, or PowerShell queries for installed hotfixes and OS build numbers matched against Microsoft’s Security Update Guide. Confirm email and web security controls detect or quarantine Internet Shortcut files, especially inside archives. Test detection coverage by safely creating a benign .url file in a controlled environment and verifying that file creation, user open events, child process creation from Explorer, and outbound network attempts are logged. Confirm firewall or proxy policy blocks unapproved outbound SMB/WebDAV traffic to the Internet.

Typical attack path

1. Attacker prepares a specially crafted Windows Internet Shortcut (.url) file designed to bypass security warnings.
2. Attacker delivers the shortcut through phishing email, archive attachment, messaging platform, malicious website, or compromised file share.
3. User opens the shortcut on an affected Windows system.
4. Windows processes the shortcut without presenting the expected SmartScreen or Internet-origin warning.
5. The shortcut contacts attacker-controlled HTTP, WebDAV, or SMB infrastructure or launches a trusted Windows handler.
6. Additional payloads are downloaded or executed using legitimate Windows processes.
7. Attacker establishes persistence, performs credential theft or reconnaissance, and may deploy ransomware or other malware.

How to detect it

Look for evidence that users received, extracted, or opened suspicious .url files, especially from email attachments, browser download directories, archive extraction paths, temporary folders, or network shares. Useful log sources include EDR file/process telemetry, Windows Security process creation events if command-line logging is enabled, Sysmon Event ID 1 for process creation, Sysmon Event ID 3 for network connections, Sysmon Event ID 11 for file creation, Sysmon Event ID 15 for Zone.Identifier alternate data streams, Microsoft Defender alerts, SmartScreen/Defender operational logs, email gateway logs, web proxy logs, DNS logs, and firewall logs. Hunt for explorer.exe spawning unusual child processes such as powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or msiexec.exe shortly after a .url file was created or opened. Also hunt for outbound SMB/WebDAV/HTTP connections to untrusted external infrastructure immediately after shortcut interaction. Because this vulnerability is a security-feature bypass, absence of a SmartScreen warning is not proof of safety; correlate shortcut file presence, child process execution, and network activity. For ransomware-oriented investigations, extend the timeline to look for credential dumping, remote service creation, lateral movement, mass file access, backup deletion, and encryption tooling after the initial shortcut execution.

• .url
• [InternetShortcut]
• URL=file://
• URL=http://
• URL=https://
• Zone.Identifier
• explorer.exe -> powershell.exe
• explorer.exe -> cmd.exe
• explorer.exe -> mshta.exe
• explorer.exe -> wscript.exe
• explorer.exe -> cscript.exe
• explorer.exe -> rundll32.exe
• explorer.exe -> regsvr32.exe
• explorer.exe -> certutil.exe
• explorer.exe -> bitsadmin.exe
• explorer.exe -> msiexec.exe
• \AppData\Local\Temp\*.url
• \Downloads\*.url
• \AppData\Local\Microsoft\Windows\INetCache\
• outbound TCP 445
• outbound TCP 139
• WebDAV
• Microsoft-WebDAV-MiniRedir

What your security team should do

• Patch all affected Windows endpoints and servers immediately; this is actively exploited, KEV-listed, high-EPSS, and associated with ransomware activity.
• Prioritize systems used by end users to open email attachments, browse the web, access shared downloads, or run remote desktop/VDI sessions.
• Hunt for recent .url files received from email, downloaded from browsers, extracted from archives, or opened from temporary directories.
• Create detections for explorer.exe or other shell handlers spawning scripting engines, command shells, mshta.exe, rundll32.exe, regsvr32.exe, or PowerShell shortly after a .url file is opened.
• Block or heavily scrutinize .url attachments and archives containing .url files at mail gateways, web proxies, and endpoint security controls.
• Restrict outbound SMB/WebDAV to the Internet and alert on endpoints attempting to authenticate to unknown external hosts over SMB or WebDAV.
• Review Defender, EDR, proxy, DNS, and Windows process telemetry for signs of payload download or execution following shortcut-file activity.
• If exploitation is suspected, isolate affected endpoints, collect memory and disk artifacts, preserve shortcut files and downloaded payloads, reset exposed credentials, and investigate lateral movement.