Follina (CVE-2022-30190): MSDT RCE via Office or ms-msdt Pattern
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Microsoft Sentinel (KQL)
