Windows MotW and SmartScreen Bypasses: Five 2024 Zero-Days

What to do

1. Find Windows machines below the October 2024 build for their version (for example 22631.4317 on Windows 11 23H2) and install the current cumulative update.
2. Patch machines that handle outside mail, chat and downloads first, including RDS and VDI hosts.
3. Quarantine .url, .lnk and .msc attachments from outside senders at the mail gateway unless the business needs them.
4. Block outbound WebDAV and SMB from workstations to the internet.
5. On any machine that opened outside shortcut or console files while unpatched in 2024, run the hunts below.

How to check if you are affected or compromised

• Compare each machine's CurrentBuild and UBR registry values with the October 2024 fixed builds.
• Hunt for a .url file opened from mail or Downloads followed by msiexec, rundll32, cmd or PowerShell; Trend Micro's reports list indicators for the Water Hydra and DarkGate chains.
• Look for explorer.exe overwriting .lnk files in Downloads or Temp, Elastic's marker of LNK stomping (CVE-2024-38217).
• Look for mmc.exe started with a .msc file from Downloads, Temp or a mail folder, then loading apds.dll or spawning scripts.

What happened#

In 2024 Microsoft patched five Windows zero-days that did the same job for attackers: let a file from the internet run without the warning meant to stop it. Windows tags downloaded files with the Mark of the Web (MotW), a Zone.Identifier stream with ZoneId=3. SmartScreen checks that tag before a file runs, as Microsoft's CVE-2024-21351 FAQ explains, and Office's Protected View relies on it too. Each bug needed a user to open a file sent by mail, chat or a website. CISA added all five to KEV.

• CVE-2024-21412 (Internet Shortcut Files, CVSS 8.1, fixed Feb 13, 2024). Trend Micro caught Water Hydra (DarkCasino) using it against financial traders, in a campaign it began tracking in late December 2023. A .url file pointed to a second .url file on a WebDAV share, which evaded the earlier fix for CVE-2023-36025 and led to the DarkMe RAT. Trend later saw DarkGate operators use it from mid-January 2024, and in July 2024 Fortinet reported a stealer campaign delivering Meduza and ACR Stealer. The KEV entry marks known ransomware use.
• CVE-2024-21351 (SmartScreen, CVSS 7.6, Feb 13, 2024). Microsoft says an attacker could inject code into SmartScreen. It credits its own Eric Lawrence. Who exploited it was not disclosed as of Oct 23, 2026.
• CVE-2024-38213 (MotW, CVSS 6.5). ZDI's "copy2pwn" write-up says files copied and pasted from a WebDAV share arrived without MotW. DarkGate operators abused it; ZDI began analyzing samples in March 2024. Microsoft fixed it in the June 2024 updates but published the CVE only on Aug 13, 2024, saying it had been "inadvertently omitted".
• CVE-2024-38217 (MotW, CVSS 5.4, Sep 10, 2024). Elastic's Smart App Control research described "LNK stomping": a shortcut with an odd target path, such as a trailing dot, makes Explorer rewrite it and drop MotW. Elastic found samples on VirusTotal, the oldest submitted over six years earlier.
• CVE-2024-43572 (Management Console, CVSS 7.8, Oct 8, 2024). Microsoft's fix "will prevent untrusted Microsoft Saved Console (MSC) files from being opened." No exploitation details were published. Tenable's Satnam Narang noted the patch came months after Elastic's GrimResource report on crafted .msc files that delivered Cobalt Strike, without tying the two.

Who is affected#

Per the CVE records, the five bugs span Windows 10, Windows 11 (24H2 for the September and October fixes) and Windows Server 2008 SP2 through 2022. CVE-2024-21412 affected only Windows 10 1809 and later, Windows 11 and Server 2019 and 2022. Cumulative updates carry earlier fixes forward, so the October 8, 2024 update closes all five. Examples: 22631.4317 (KB5044285) on Windows 11 23H2, 26100.2033 (KB5044284) on 24H2, 19045.5011 (KB5044273) on Windows 10 22H2 and 20348.2762 (KB5044281) on Server 2022.

Do you really need to act?#

For most teams, only a check. These fixes are two years old, and any machine that took a monthly update since October 2024 is covered. The risk sits in machines that quietly stopped updating: unmanaged laptops, kiosks, lab PCs and old RDS hosts. Those also miss later bugs of the same kind. KEV lists CVE-2024-29988, a SmartScreen prompt bypass chained with CVE-2024-21412; CVE-2025-26633, another exploited MMC flaw; and the Windows Shell bypasses CVE-2026-21510 and CVE-2026-96951, the latter a MotW bypass fixed this month. The lesson from 2024: warning prompts are one layer, not a control. Keep the file types attackers reuse (.url, .lnk, .msc) out of inboxes.

What to do now#

1. Check builds: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR. Anything below the October 2024 floor for its version, such as 22631 and 4317 on Windows 11 23H2, needs the current cumulative update.
2. Patch mail, chat and download-heavy machines first, including RDS and VDI hosts.
3. At the mail gateway, quarantine .url, .lnk and .msc attachments from outside senders unless there is a business need.
4. Block outbound WebDAV and SMB from workstations to the internet. The Water Hydra and DarkGate chains pulled their next stage from attacker WebDAV shares.

How to tell if you were hit#

Only machines that opened outside files while unpatched in 2024 matter. Hunt in EDR or retained logs for:

• A .url file opened from mail or Downloads, followed by msiexec, rundll32, cmd or PowerShell. Trend's reports list indicators for both chains.
• explorer.exe overwriting .lnk files in Downloads or Temp, which Elastic calls anomalous and a sign of LNK stomping.
• mmc.exe started with a .msc file from Downloads, Temp or a mail folder, then loading apds.dll or spawning scripts, as in Elastic's GrimResource rules.

Treat a hit followed by a RAT or stealer as a compromise: reimage the machine and reset the user's passwords and sessions.

Timeline#

• Feb 13, 2024 — Microsoft fixes CVE-2024-21412 and CVE-2024-21351; CISA adds both to KEV; Trend publishes its Water Hydra report.
• Mar 13, 2024 — Trend reports DarkGate exploiting CVE-2024-21412.
• Jun 22, 2024 — Elastic publishes GrimResource.
• Jul 23, 2024 — Fortinet reports the stealer campaign.
• Aug 6, 2024 — Elastic publishes LNK stomping research.
• Aug 13, 2024 — Microsoft discloses CVE-2024-38213, fixed in June; CISA adds it to KEV.
• Sep 10, 2024 — CVE-2024-38217 fixed and added to KEV.
• Oct 8, 2024 — CVE-2024-43572 fixed and added to KEV.

Vulnerability records

• CVE-2024-21412 · KEV 2024-02-13 · Internet Shortcut Files Security Feature Bypass Vulnerability
• CVE-2024-21351 · KEV 2024-02-13 · Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2024-38213 · KEV 2024-08-13 · Windows Mark of the Web Security Feature Bypass Vulnerability
• CVE-2024-38217 · KEV 2024-09-10 · Windows Mark of the Web Security Feature Bypass Vulnerability
• CVE-2024-43572 · KEV 2024-10-08 · Microsoft Management Console Remote Code Execution Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2024-21412 Internet Shortcut Files Security Feature Bypass Vulnerability msrc.microsoft.com
2. Microsoft MSRC — CVE-2024-21351 Windows SmartScreen Security Feature Bypass Vulnerability msrc.microsoft.com
3. Microsoft MSRC — CVE-2024-38213 Windows Mark of the Web Security Feature Bypass Vulnerability msrc.microsoft.com
4. Microsoft MSRC — CVE-2024-38217 Windows Mark of the Web Security Feature Bypass Vulnerability msrc.microsoft.com
5. Microsoft MSRC — CVE-2024-43572 Microsoft Management Console Remote Code Execution Vulnerability msrc.microsoft.com
6. Microsoft MSRC — October 2024 Security Updates (CVRF) api.msrc.microsoft.com
7. CVE record — CVE-2024-21412 cve.org
8. CISA — Known Exploited Vulnerabilities: CVE-2024-21412 cisa.gov
9. Trend Micro — CVE-2024-21412: Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day trendmicro.com
10. Trend Micro — CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign trendmicro.com
11. Zero Day Initiative — CVE-2024-38213: Copy2Pwn Exploit Evades Windows Web Protections zerodayinitiative.com
12. Elastic Security Labs — Dismantling Smart App Control elastic.co
13. Elastic Security Labs — GrimResource: Microsoft Management Console for initial access and evasion elastic.co
14. Fortinet FortiGuard Labs — Exploiting CVE-2024-21412: A Stealer Campaign Unleashed fortinet.com
15. CXOToday — Comment on October 2024 Patch Tuesday: Satnam Narang, Tenable cxotoday.com