Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
19
5
4
1
1
Contributors
19
5
4
1
1
Categories
20
9
5
3
2
Platforms
30
1
Products / Services
14
11
5
4
2
MITRE Techniques
18
13
8
8
7
CVEs
71
71
64
58
49
30
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to exploit the Microsoft Support Diagnostic Tool (MSDT) vulnerability CVE-2022-30190, known as 'Follina'. The rules monitor for malicious HTTP traffic and payloads that leverage the 'ms-msdt' URI scheme to execute arbitrary commands, often delivered via weaponized documents or external references to remote malicious HTML files.
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Detects the Microsoft Support Diagnostic Tool (msdt.exe) being launched by Office applications or web browsers using the ms-msdt protocol handler or PCWDiagnostic parameters, which is indicative of the Follina (CVE-2022-30190) vulnerability exploitation.
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Detects network activity related to the exploitation of the Microsoft Support Diagnostic Tool (MSDT) vulnerability known as Follina (CVE-2022-30190), characterized by URIs containing both the CVE identifier and the MSDT string.
Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)
Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library
Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability
Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Detects a suspicious process spawning from an Outlook process.
Detects msdt.exe creating files in suspicious directories, which could indicate exploitation of vulnerabilities like Follina (CVE-2022-30190) or Dogwalk. The rule specifically looks for file creations in common startup locations, public user directories, or system logs directories.
Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities
Detects the execution of 'msdt.exe' with the '-cab' flag, which is indicative of suspicious diagnostic cabinet (.diagcab) files potentially leveraging CVE-2022-30190 (Follina vulnerability) to execute embedded answer files. This technique can be used for defense evasion and indirect command execution.
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands, as seen in the Follina (CVE-2022-30190) vulnerability. The rule specifically looks for execution of msdt.exe combined with command-line arguments indicative of arbitrary command execution, either through an inline command or by specifying an answer file.
The analytic detects path traversal command-line execution, often used in malicious documents to execute code via msdt.exe for defense evasion. It leverages Endpoint Detection and Response (EDR) data, focusing on specific patterns in process paths. This activity is significant as it can indicate an attempt to bypass security controls and execute unauthorized code. If confirmed malicious, this behavior could lead to code execution, privilege escalation, or persistence within the environment, potentially allowing attackers to deploy malware or leverage other living-off-the-land binaries (LOLBins).
The analytic detects a Microsoft Office product spawning the Windows msdt.exe process. This activity is significant as it may indicate an attempt to exploit protocol handlers to bypass security controls, even if macros are disabled. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
Page 1 of 2