Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Description

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Query · sigma

selection:
  TargetObject|startswith: HKCR\ms-msdt\
condition: selection

Known false positives

  • Unknown
Raw source Suspicious Set Value of MSDT in Registry (CVE-2022-30190) · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
id: 2d9403d5-7927-46b7-8216-37ab7c9ec5e3
status: test
description: Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
    - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
author: Sittikorn S
date: 2020-05-31
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1221
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|startswith: 'HKCR\ms-msdt\'
    condition: selection
falsepositives:
    - Unknown
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.