CVE-2016-3351
Microsoft Internet Explorer and Edge — Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Description
Response & Mitigation
Why act now?
Prioritisation rationale
Despite a moderate CVSS score of 6.5, CVE-2016-3351 sits at the 97.9th EPSS percentile and carries CISA's "Known Ransomware Campaign Use" flag, making it a high-priority remediation item. The vulnerability was actively weaponised in exploit kits to enumerate files and system configurations on victim machines — a reconnaissance step that feeds directly into payload delivery in multi-stage ransomware chains. Target profiles are concentrated in organisations still running IE or Legacy Edge in production, particularly sectors with long patch cycles such as manufacturing, healthcare, and public administration — all of which fall within NIS2 scope. Organisations that have fully retired IE and Legacy Edge face negligible residual risk; for all others, patching or decommissioning the affected browsers is the only fully effective control.
Runbook · Step 1
Immediate response (0-24 h)
- Apply Microsoft security updates for Internet Explorer 9, 10, and 11 and Microsoft Edge (Legacy) immediately via Windows Update or WSUS — look up the exact KB number in the Microsoft Security Response Center (MSRC) advisory for CVE-2016-3351.
- Disable Internet Explorer on all managed endpoints via Group Policy if no business-critical dependency exists; IE reached end-of-life in June 2022 and should not be running in any production environment.
- Replace Microsoft Edge Legacy (EdgeHTML-based) with Chromium-based Microsoft Edge — Legacy Edge no longer receives security updates.
- Quarantine unpatched endpoints (VLAN isolation or NAC enforcement) until the update is confirmed deployed.
- Review proxy and DNS logs for connections to known exploit-kit infrastructure from the period before patching, focusing on systems where IE or Legacy Edge usage was recorded.
- Rotate session tokens and enforce least-privilege accounts for any users running IE or Legacy Edge with elevated rights.
Runbook · Step 2
Mitigation layers
- Network segmentation: Route all outbound HTTP/HTTPS traffic from endpoints running unpatched IE/Edge through a TLS-inspecting proxy; block direct port 80/443 egress that bypasses the proxy.
- WAF/IPS: Enable Snort/Suricata rules detecting HTTP responses containing
file://URI references in the body — this is the mechanism used to probe for file existence on the victim's filesystem. - Endpoint hardening: Enable Enhanced Protected Mode (EPM) in Internet Explorer via Group Policy (
Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Advanced Page > Turn on Enhanced Protected Mode); this restricts filesystem access from the browser process. - Zone configuration: Set the Internet Zone security level to "High" in IE; disable ActiveX, scripting, and file downloads in the Internet Zone via GPO.
- IAM/least privilege: Prevent browser processes from running with elevated rights — enforce this with AppLocker or Windows Defender Application Control (WDAC) policies that block elevated IE instances.
- Threat intelligence: Ingest IOCs from exploit-kit campaigns known to have leveraged CVE-2016-3351 (Angler, Neutrino, RIG families) into your SIEM and DNS sinkhole.
Runbook · Step 3
Detection rules
- Sysmon EID 3 (network connection):
iexplore.exeorMicrosoftEdge.exeestablishing outbound connections to public IPs — KQL:DeviceNetworkEvents | where InitiatingProcessFileName in ("iexplore.exe","MicrosoftEdge.exe") | where RemoteIPType == "Public". - Sysmon EID 1 (process creation): Child processes spawned by
iexplore.exeorMicrosoftEdge.exe— Sigma shape:ParentImage|endswith: '\iexplore.exe'combined withImage|endswith: '\cmd.exe'or'\powershell.exe'. - Web proxy logs: HTTP responses containing
file:///C:/orfile:///Windows/in the response body — SPL:index=proxy | search body="file:///C:/". - Proxy User-Agent analysis: Requests advertising IE versions below 11.0.x or Edge/13 in the User-Agent string indicate unpatched clients still in use — alert and escalate for immediate remediation.
- EDR telemetry:
iexplore.exeaccessing filesystem paths outside the browser cache (%LOCALAPPDATA%\Microsoft\Windows\INetCacheexcluded) — flag reads against%USERPROFILE%\Documents,%APPDATA%, or%SYSTEMROOT%by the browser process as high-severity alerts.
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
microsoft
edge
microsoft
internet_explorer
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- http://www.securitytracker.com/id/1036789vdb-entryx_refsource_SECTRACK
- http://www.securityfocus.com/bid/92788vdb-entryx_refsource_BID
- https://www.brokenbrowser.com/detecting-apps-mimetype-malware/x_refsource_MISC
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104vendor-advisoryx_refsource_MS
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105vendor-advisoryx_refsource_MS
- http://www.securitytracker.com/id/1036788vdb-entryx_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3351government-resource