An Inside Look into Microsoft Rich Text Format and OLE Exploits

This McAfee technical report analyzes how attackers weaponize Microsoft RTF files via OLE functionality — describing RTF control words, overlay data, linked and embedded OLE objects (including Monikers and OLE packages), and examples tied to CVE-2015-1641, CVE-2017-0199, CVE-2017-8756 and CVE-2018-0802 — and recommends extracting and inspecting embedded/linked objects and streams to detect and mitigate these exploitation and malware delivery techniques.