Possible Follina (CVE-2022-30190) exploitation attempt detected. New process created by a Microsoft Office application.

Description

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60004 Group of Windows rules for the sysmon channel. anchor level 0
   field win.system.channel="^Microsoft-Windows-Sysmon/Operational$"
3. 61600 Windows Sysmon informational event anchor level 0
   field win.system.severityValue="^INFORMATION$"
4. 61603 Sysmon - Event 1: Process creation · win.system.eventID = 1 anchor level 0
   field win.system.eventID="^1$"
5. 100100 Sysmon - Event 1: Process creation · rule 100100 anchor level 3
   Matches no fields of its own.
6. 100105 Sysmon - Event 1: Process creation · Obfuscated Files or Information (T1027) anchor level 3
   field win.eventdata.ruleName="^technique_id=T1027,technique_name=Obfuscated Files or Information$"
7. 100506 Sysmon - Event 1: Process creation · win.eventdata.parentImage = winword\.exe$|excel\.exe$|powerpnt\.exe$|outlook\.exe$|msac… anchor level 10
   field win.eventdata.parentImage="winword\.exe$|excel\.exe$|powerpnt\.exe$|outlook\.exe$|msaccess\.exe$|lync\.exe$|mspub\.exe$|onenote\.exe$"
8. 900110 Possible Follina (CVE-2022-30190) exploitation attempt detected. New process created by a Microsoft Office application. exclusion level 10 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 100506
  • Sysmon - Event 1: Process creation · win.eventdata.parentImage = winword\.exe$|excel\.exe$|powerpnt\.exe$|outlook\.exe$|msac…