Potential Arbitrary Command Execution Using Msdt.EXE (Follina CVE-2022-30190)

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•17

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands, as seen in the Follina (CVE-2022-30190) vulnerability. The rule specifically looks for execution of msdt.exe combined with command-line arguments indicative of arbitrary command execution, either through an inline command or by specifying an answer file.