Suspicious MSDT Parent Process (Follina CVE-2022-30190)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the execution of msdt.exe by a suspicious parent process, which is indicative of exploitation techniques such as the 'Follina' vulnerability (CVE-2022-30190). The rule specifically looks for msdt.exe being spawned by common scripting or system utility processes often abused in such attacks.