detect-office-applications-spawning-msdt-CVE-2022-30190

Description

This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190). The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe. References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190 https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/ https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug https://attack.mitre.org/techniques/T1221/

Query · kql

// Office products spawning MSDT
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
and FileName =~"msdt.exe"
Raw source detect-office-applications-spawning-msdt-CVE-2022-30190 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cd1c9815-1f2c-483e-a875-b81bfcc1489b
name: detect-office-applications-spawning-msdt-CVE-2022-30190
description: |
  This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190).
  The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
  References:
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
  https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
  https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
  https://attack.mitre.org/techniques/T1221/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense Evasion
relevantTechniques:
  - T1221
query: |
  // Office products spawning MSDT
  DeviceProcessEvents
  | where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
  and FileName =~"msdt.exe"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.