SecBoard
Zurück zur CVE-Übersicht

CVE-2025-60710

HIGH(7.8)KEV — Aktiv ausgenutzt

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score51/100 — HOCH
  • CVSS 7.8 — Hoch
  • Im CISA KEV-Katalog (aktiv ausgenutzt)

Erwähnungen (letzte 60 Tage)

Artikel

CISA KEV

Bestätigt ausgenutzt

EPSS-Score

4.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

SecBoard-Einordnung

CVE-2025-60710 betrifft den Host Process for Windows Tasks in Microsoft Windows und ermöglicht eine lokale . Die Schwachstelle basiert auf einer fehlerhaften Link-Auflösung vor dem Dateizugriff ('link following'), die es einem autorisierten Angreifer erlaubt, seine Berechtigungen zu erhöhen. Dies kann zu unbefugtem Zugriff auf sensible Systemfunktionen oder Daten führen.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

Erkennung & Indikatoren

Ausnutzung

CISA confirmed that ransomware gangs are exploiting this high-severity Windows Task Host vulnerability. It was flagged as actively exploited on April 13, and CISA updated its KEV catalog to flag it as being abused by ransomware gangs.

Threat-Hunting-Queries

This vulnerability is a local privilege escalation due to improper link resolution before file access. Detection should focus on unusual process behavior, especially processes attempting to access or modify system files with elevated privileges after starting with lower privileges, or suspicious file operations involving symbolic links or junctions.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("taskhostw.exe", "taskhost.exe")
| where ProcessCommandLine contains ".lnk" or ProcessCommandLine contains ".symlink" or ProcessCommandLine contains ".junction"
| where ProcessIntegrityLevel == "System"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, ProcessIntegrityLevel, InitiatingProcessParentFileName, InitiatingProcessCommandLine
| join kind=leftouter (
    DeviceFileEvents
    | where ActionType == "FileCreated" or ActionType == "FileModified"
    | where FileName contains ".lnk" or FileName contains ".symlink" or FileName contains ".junction"
    | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
) on DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where isnotempty(FileName1)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, ProcessIntegrityLevel, InitiatingProcessParentFileName, InitiatingProcessCommandLine, CreatedFileName = FileName1, CreatedFilePath = FolderPath1

Splunk SPL

(sourcetype="WinEventLog:Security" EventCode=4688 NewProcessName IN ("*\\taskhost.exe", "*\\taskhostw.exe") CommandLine IN ("*.lnk", "*.symlink", "*.junction")) OR (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image IN ("*\\taskhost.exe", "*\\taskhostw.exe") CommandLine IN ("*.lnk", "*.symlink", "*.junction"))
| stats count by _time, Host, Image, CommandLine, ParentImage, ParentCommandLine
| join type=left (
    (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename IN ("*.lnk", "*.symlink", "*.junction")) OR (sourcetype="WinEventLog:Security" EventCode=4663 ObjectName IN ("*.lnk", "*.symlink", "*.junction"))
    | stats count by _time, Host, Image, TargetFilename, SourceImage
) on Host
| where isnotnull(TargetFilename)
| table _time, Host, Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename, SourceImage

Sigma

title: Windows Task Host Link Following EoP
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential exploitation of CVE-2025-60710, a privilege escalation vulnerability in Windows Task Host due to improper link resolution.
author: SecBoard
date: 2026/08/18
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-60710
  - https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/
tags:
  - attack.privilege_escalation
  - cve.2025.60710
  - cisa_kev
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\taskhost.exe'
      - '\taskhostw.exe'
    CommandLine|contains:
      - '.lnk'
      - '.symlink'
      - '.junction'
  selection_file_op:
    EventID: 11 # Sysmon FileCreate
    TargetFilename|contains:
      - '.lnk'
      - '.symlink'
      - '.junction'
  condition: selection_process and selection_file_op
falsepositives:
  - Legitimate software creating or interacting with symbolic links/junctions via Task Host, requires tuning.
level: high

Elastic ES|QL

from process where process.executable.endswith any ('\\taskhost.exe', '\\taskhostw.exe') and process.command_line.text.contains any ('.lnk', '.symlink', '.junction')
| join from file where event.action == 'creation' and file.path.contains any ('.lnk', '.symlink', '.junction') on process.entity_id
| select @timestamp, host.name, process.executable, process.command_line, process.parent.executable, process.parent.command_line, file.path, file.name, event.action

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

Referenzen