Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation

Hunt Hypothesis

This hunt hypothesis identifies adversaries leveraging the ms-msdt URI scheme to execute Office Document Object Model (DOM) attacks, specifically targeting the Follina vulnerability (CVE-2022-30190) which allows remote code execution without requiring user interaction. A proactive search within Azure Sentinel is critical because this technique often bypasses traditional email security controls by exploiting trusted Microsoft components to establish initial footholds and exfiltrate sensitive data before standard detection triggers activate.

YARA Rule

rule EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 {
   meta:
      description = "Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation"
      author = "Tobias Michalski, Christian Burkard"
      date = "2022-05-30"
      modified = "2022-07-18"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      hash1 = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
      hash2 = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
      score = 80
      id = "62e67c25-a420-5dac-9d1c-b0648ea6b574"
   strings:
      $re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
      $a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii /* URL encoded "ms-msdt:/" */
   condition:
      filesize > 3KB and
      filesize < 100KB and
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ms-msdt URI detection rule, including tailored filters and exclusions:

• Scenario: Automated Office Document Repair via PowerShell Scripts

  • Context: Enterprise IT teams often deploy PowerShell scripts to automatically repair corrupted Office documents (.docx, .xlsx) stored in network shares. These scripts invoke msdt.exe with the -id parameter to trigger the MS-Diagnostic Tool for document integrity checks, mimicking the Follina attack vector.
  • Filter/Exclusion: Exclude processes where the parent process is a known scripting engine (e.g., powershell.exe, cscript.exe) running under a specific service account (e.g., DOMAIN\IT-AutoRepair).
    • Logic: ProcessName == "msdt.exe" AND ParentImageName IN ("powershell.exe", "cscript.exe") AND UserAccount IN ("DOMAIN\IT-AutoRepair", "DOMAIN\BackupService")

• Scenario: Scheduled System Health Diagnostics via Task Scheduler

  • Context: The organization utilizes a scheduled task (e.g., “SystemHealthCheck”) that runs nightly to generate diagnostic reports. This task explicitly launches msdt.exe with the URI ms-msdt://id=PCDiag to collect hardware and software telemetry, which triggers the rule due to the presence of the ms-msdt protocol in the command line arguments.
  • Filter/Exclusion: Create an exclusion for specific Task Scheduler IDs or process paths associated with known maintenance jobs.
    • Logic: Exclude if CommandLine contains ms-msdt://id=PCDiag AND ProcessPath matches C:\Program Files\SystemHealth\tools\msdt.exe.

• Scenario: User-Initiated Office Support Tool Launch

  ---