Suspicious Registry Modification for MSDT (CVE-2022-30190)

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•27

Detects modifications to the 'ms-msdt' URI scheme in the Windows Registry, specifically when the 'TargetObject' starts with 'HKCR\ms-msdt\'. This activity could indicate an attempt to exploit CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability, often referred to as "Follina". The vulnerability allows for remote code execution via specially crafted Microsoft Office documents.