FILE-OFFICE Microsoft MSHTML ActiveX control bypass attempt. It started this morning.

Question

Keep on getting this notification email every 5 minutes from XGS2100 firewall. Affects only one user's computer. FILE-OFFICE Microsoft MSHTML ActiveX control bypass attempt. It started this morning. Please assist. These four IP's external are listed so far in the IPS logs. 104.21.21.192 188.114.96.7 188.114.97.7 172.67.200.13

This thread was automatically locked due to age.

Erick Jan · Answer

Hi Francois, 
 Thank you for reaching out to Sophos Community. 
 Kindly refer to the following links below. 
 
 Windows zero-day MSHTML attack is a known issue. 
 
 Windows zero-day MSHTML attack &ndash; how not to get booby trapped! 
 FILE-OFFICE Microsoft MSHTML ActiveX control bypass attempt